百科虾

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:39 AM UTC
• Version: 2.2.1

Overview

This Feishu knowledge-base skill is mostly coherent, but it needs review because it can use local credentials to send messages and upload local files with weak path and account controls.

Review before installing. Use only a dedicated least-privilege Feishu app account, restrict who can run sync and send-message.js, reject untrusted wiki content that can contain MEDIA markers, and patch path containment, account fallback, redirect-token handling, and verbose logging before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send-message.js:38

Finding

Arbitrary Local File Upload Through Unrestricted Media Paths

Content

View full analysis

Remediation

View remediation

/cache/images` - `/cache/files` 3. Perform the containment check using a path-separator-aware comparison. 4. Reject symbolic links or verify their final canonical targets. 5. Allow only approved file extensions and validate the actual MIME signature. 6. Enforce conservative file-size limits before reading files into memory. 7. Require explicit authorization before uploading a file derived from synchronized Wiki content. 8. Avoid using the current working directory as a security boundary. 9. Treat `IMG:` paths with the same validation as `MEDIA:` paths. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/send-message.js:57

Finding

Cross-Agent Credential Use Through Silent Account Fallback

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync.js:15

Finding

Workspace Path Traversal Through Unvalidated Agent Name

Content

View full analysis

arg.startsWith('--agent=')); const AGENT_NAME = agentArg ? agentArg.split('=')[1] : null; if (!AGENT_NAME) { console.error('An agent name must be specified with --agent='); console.error('Example: node sync.js --agent=baikexia'); process.exit(1); } const WORKSPACE_DIR = path.join( SKILL_DIR, '..', '..', '..', `workspace-${AGENT_NAME}` ); const CACHE_DIR = path.join(WORKSPACE_DIR, 'cache'); const IMAGES_DIR = path.join(CACHE_DIR, 'images'); const FILES_DIR = path.join(CACHE_DIR, 'files'); const BOARDS_DIR = path.join(CACHE_DIR, 'boards'); ``` The derived paths are subsequently used for directory creation and file writes: ```js fs.mkdirSync(IMAGES_DIR, { recursive: true }); fs.mkdirSync(FILES_DIR, { recursive: true }); fs.mkdirSync(BOARDS_DIR, { recursive: true }); ``` ### Technical Analysis `AGENT_NAME` is taken directly from a command-line argument and may contain path separators or traversal sequences. It is interpolated into a path and normalized by `path.join()` without validation. The derived directories receive downloaded attachments, images, board metadata, synchronized content, and synchronization metadata. Therefore, controlling `AGENT_NAME` can redirect these writes outside the intended agent workspace. The vulnerability requires the ability to influence the synchronization command or its arguments, but the Skill documentation exposes synchronization as an agent-admin command, making strict validation important. ### Attack Path 1. An attacker or compromised automation invokes synchronization with a crafted argument, such as `--agent=../../../attacker-controlled-location`. 2. `AGENT_NAME` is inserted into `workspace-${AGENT_NAME}` without validation. 3. `path.joi ...[truncated 774 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync.js:124

Finding

Feishu Bearer Token Forwarded Across Unvalidated Redirects

Content

View full analysis

{ const urlObj = new URL(url); const opts = { hostname: urlObj.hostname, path: urlObj.pathname + urlObj.search, method: 'GET', headers: { 'Authorization': `Bearer ${token}`, 'Accept': 'image/*,*/*' } }; const req = https.request(opts, (res) => { if (res.statusCode === 301 || res.statusCode === 302) { const redirectUrl = res.headers.location; if (redirectUrl) { downloadBinary(redirectUrl, destPath, token) .then(resolve) .catch(reject); return; } } ``` ### Technical Analysis The downloader follows HTTP redirects recursively without validating the destination hostname. The same Feishu bearer token is passed to every redirected request and included in the `Authorization` header. If a Feishu media response redirects to a different origin, whether through expected storage behavior, service compromise, or another upstream condition, the redirected host receives the tenant bearer token. The implementation also lacks a redirect limit and explicit origin comparison. The initial authenticated download from Feishu is necessary for synchronization. Forwarding the token to a different origin is not necessary and violates credential-scoping principles. ### Attack Path 1. The synchronization script requests an authenticated media download from the Feishu API. 2. The endpoint responds with HTTP 301 or 302 and a `Location` header referencing another host. 3. `downloadBinary()` follows the supp ...[truncated 644 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send-message.js:323

Finding

Sensitive Corporate Messages and User Identifiers Written to Logs

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/sync.js:919

Finding

Undefined Wiki Variables Cause Synchronization Failure and Stale Security-Relevant Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared behavior says the skill only answers from a local knowledge base and does not search online, but the documentation explicitly describes network synchronization with Feishu APIs, credential reads from ~/.openclaw/openclaw.json, recursive wiki traversal, and attachment downloads. In context, this broadens the trust boundary from passive answering to privileged data synchronization, increasing risk of overcollection, credential misuse, and unintended access to sensitive company content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared behavior says the skill only answers from a local knowledge base and does not search online, but the documentation explicitly describes network synchronization with Feishu APIs, credential reads from ~/.openclaw/openclaw.json, recursive wiki traversal, and attachment downloads. In context, this broadens the trust boundary from passive answering to privileged data synchronization, increasing risk of overcollection, credential misuse, and unintended access to sensitive company content.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

| `同步知识库` | 执行 `sync.js` 增量同步（内容变化才更新） |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

| `同步知识库` | 执行 `sync.js` 增量同步（内容变化才更新） |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

| `同步知识库` | 执行 `sync.js` 增量同步（内容变化才更新） |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

| `同步知识库` | 执行 `sync.js` 增量同步（内容变化才更新） |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

### scripts/send-message.js

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script implements broad outbound messaging to Feishu, including text, mentions, and image delivery, which materially exceeds the declared role of a company encyclopedia/Q&A skill. In this context, the capability can be abused to exfiltrate user-provided content or local data, or to perform unauthorized communications through corporate messaging infrastructure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code loads Feishu app credentials from local configuration and uses them to obtain access tokens for message sending. For a knowledge-base skill, embedding the ability to silently use local credentials to act on external services creates an unjustified privilege boundary crossing and enables unauthorized outbound actions if the skill is triggered or modified.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/sync.js (reported line 907)May include surrounding context.

js

try {
        accessToken = await getToken();
        log('获取access token成功');

        fs.mkdirSync(IMAGES_DIR, { recursive: true });
        fs.mkdirSync(FILES_DIR, { recursive: true });

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents shell execution and environment-dependent behavior (node ..., workspace paths, credential files) but does not declare any explicit tool or permission scope. This creates an authorization gap where a seemingly simple Q&A skill can use broader execution capabilities than users or reviewers would expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill triggers whenever a user asks a company-related question, but it does not define specific trigger phrases, contexts, or exclusion conditions. This broad natural-language condition could overlap with many ordinary workplace queries and cause unintended invocation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation explicitly points to stored credentials in openclaw.json, revealing where sensitive tokens live and implying the skill can access them. Even without exposing the secret values directly, this increases the attack surface by normalizing credential access for a skill whose stated purpose is simple employee Q&A.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The markdown notes that credentials are stored in openclaw.json, but it does not include a user-facing warning about handling secrets, access restrictions, or avoiding accidental disclosure. Because the skill interacts with credentials and cached workspace data, the description should explicitly warn about these sensitive artifacts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation includes outbound message-sending behavior, including @mentions and media delivery, which is broader than a passive company knowledge-answering function. In this context, outbound messaging can be misused to send unauthorized messages, leak cached knowledge-base content, or impersonate an official assistant channel.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest says the skill should not use internet search, which conveys a constrained, non-networked answering scope to users. Yet the documented implementation includes sync.js, which connects to Feishu APIs to retrieve and synchronize wiki content; while this is not web search, it is still external network retrieval not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The image upload path reads local files and sends their contents to Feishu as message images without an explicit warning that local file contents are leaving the system. This is dangerous because a skill presented as an internal encyclopedia helper should not unexpectedly export local artifacts, and user-controlled paths could cause unintended disclosure of sensitive images.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script logs and then sends message content, mentions, and recipient information to Feishu without any explicit user-facing warning or consent at the point of transfer. In a company Q&A skill, users may reasonably expect local answer generation rather than external transmission of potentially sensitive internal questions or metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script reads Feishu app credentials from local OpenClaw configuration files and extracts appId/appSecret, but there is no user-facing warning, prompt, or descriptive comment disclosing that local credentials will be accessed. For a code file, accessing sensitive environment or credential material should have some visible disclosure unless it is clearly documented elsewhere in the skill description, which is not shown here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function retrieves binary data over HTTPS and writes it directly to destPath, and later callers use it to save images and attachments into local cache directories. Although there are operational logs during some downloads, there is no upfront disclosure that the sync process will write downloaded files to the filesystem, which is a safety-relevant file-write behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

技能声明的目标是回答制度、福利、流程、组织架构等公司问题，但这里实现了对 mention_user 的逐个联系人查询，并记录完整 API 响应日志。这是额外的人事目录访问能力，不是实现公司知识问答所必需，尤其代码注释还称“不调 API”但实际保留了调用函数。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sync script actively downloads and stores images, file attachments, and board metadata from Feishu into the local workspace cache. That materially expands data collection beyond plain FAQ text and can expose sensitive internal documents, media, or artifacts to local persistence, backup systems, or other processes with filesystem access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script extracts wiki tokens from document text and recursively syncs linked wiki pages, which can cause collection of content outside the explicitly configured wiki scope. This creates scope creep and may ingest unrelated or more sensitive internal material simply because it was linked from an allowed page.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The main flow writes synchronized knowledge-base content and metadata to local files such as content.json and metadata.json. While the script logs that cache updates are starting, it does not clearly disclose beforehand that remote document contents will be stored locally, which is relevant to user data handling and local file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file’s natural-language strings and header explicitly position the tool as Chinese-only, and all user-facing output is in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no alternative or choice is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.