Weekly Menu 每周菜单

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

The skill’s meal-planning goal is legitimate, but it asks the agent to handle Feishu credentials, read general memory for a folder token, and exposes document delete/move API examples without sufficient scoping or user control.

Review this skill carefully before installing. It is not clearly malicious, but only use it if you are comfortable with it reading meal preferences, making external recipe searches, creating and editing Feishu documents, and handling Feishu credentials. Prefer moving Feishu credentials and folder tokens into a scoped connector or secret store, narrowing activation to explicit weekly-menu document requests, and removing the delete/move API examples unless they become explicit user-confirmed features.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:87

Finding

Broad Agent Memory Access for Feishu Folder Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/feishu-doc-recipe.md:5

Finding

Feishu Application Secret Passed Through a Shell Command

Content

View full analysis

","app_secret":""}' ``` Read `app_id` and `app_secret` from `~/.openclaw/openclaw.json` → `channels.feishu.accounts.default`. ``` ### Technical Analysis The documented procedure instructs the agent to read a long-lived Feishu application secret from a local configuration file and interpolate it into curl request arguments. When placeholders are replaced with real values, the secret can become visible in shell command arguments, execution transcripts, debugging output, audit logs, process-monitoring interfaces, or agent tool-call records. The `-s` option only suppresses curl's progress output; it does not protect command arguments or redact the request body. Possession of both the application ID and application secret allows authentication against Feishu's tenant-token endpoint. The resulting tenant access token inherits the application's configured scopes, including the document and drive permissions identified by the skill prerequisites. No hardcoded credential is included in the repository, and the request is sent to the official Feishu API over HTTPS. The vulnerability concerns unsafe runtime handling of the locally stored secret. ### Attack Path 1. The weekly-menu workflow reaches the Feishu document-creation phase. 2. The agent reads `app_id` and `app_secret` from `~/.openclaw/openclaw.json`. 3. The values are substituted into the curl command's JSON argument. 4. The expanded command is exposed through an agent transcript, shell logging, process inspection, debugging telemetry, or another local observation channel. 5. An attacker o ...[truncated 981 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The reference explicitly walks through obtaining a tenant access token, which is credential use for a multi-tenant enterprise service. In the context of a meal-planning skill, this materially increases risk because the skill couples benign content generation with privileged enterprise API access that can be reused for broader actions.

Content

Scanner excerpt · references/feishu-doc-recipe.md (reported line 5)May include surrounding context.

Step-by-step API calls for creating a weekly menu Feishu document with images.

1. Get Tenant Access Token

bash

curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on generic food-planning requests, which can cause the skill to run external searches, create files, and write history when the user may have only wanted a simple chat response. In this skill's context, overbroad invocation expands the chance of unnecessary data processing and external actions without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill says it will create a user profile if one does not exist and later append menu history, but it does not require explicit notice or consent before persisting personal preference data. Because the profile includes location, household, equipment, spice tolerance, and schedule, silent creation and updating of these files creates a privacy and transparency issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill performs Xiaohongshu searches and downloads dish images from external sources without a clear privacy warning to the user. Even if the queries are recipe-related, they may still encode location, preferences, equipment, or other profile-derived attributes and disclose them to third parties without transparency.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly indicates that a Feishu drive token is stored in MEMORY.md, which is a poor secret-handling practice unrelated to normal meal-planning behavior. Storing reusable access tokens in general agent memory increases the chance of unintended disclosure to other skills, prompts, logs, or users, and could allow unauthorized access to Feishu documents and drive contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feishu-doc-recipe.md (reported line 8)May include surrounding context.

1. Get Tenant Access Token

bash

curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs the agent to read Feishu app credentials from a local configuration file, which is a sensitive credential source not justified within the visible meal-planning logic. Embedding secret-access instructions in a recipe skill expands the skill from content generation into privileged account access and enables unauthorized API use if the skill is invoked broadly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions direct access to stored Feishu credentials without disclosing that secrets will be read or that external API actions will occur. This undermines informed consent and makes a seemingly harmless meal-planning skill materially more dangerous because it silently leverages persistent credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including document deletion capability is beyond the stated purpose of generating a weekly menu and introduces unnecessary destructive power. If the skill or a downstream agent follows this reference, it could delete arbitrary Feishu documents using the same token without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A destructive delete command is presented as routine reference material with no warning, approval requirement, or guardrails. In an agent setting, undocumented destructive actions create a meaningful risk of accidental or abusive document loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The profile template sets country: "CN" and timezone: "Asia/Shanghai" as defaults, which imposes a specific locale on all users of the template. Under the policy criteria, locale constraints should either be optional, user-selected, or clearly documented as region-specific and justified; that is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The move-document API exceeds the minimal permissions needed for menu creation and storage, creating an unnecessary ability to reorganize or hide files. While less destructive than deletion, it still allows unintended modification of user data location and workflow state.

Content

No source excerpt is available for this finding.