Feishu Bot Full Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 1.0.0

Overview

The skill does create Feishu bots as advertised, but it uses broad Feishu permissions, unsafe credential handling, and risky runtime installation behavior that should be reviewed before use.

Install only if you are comfortable letting this skill automate Feishu developer actions from your logged-in session, request many high-impact Feishu permissions, modify the local Python/system environment during setup, and expose the generated app_secret through chat history. Prefer a revised version with minimal opt-in permission profiles, pinned dependencies, no remote bootstrap execution, verified TLS, isolated temp paths, and secret delivery outside persistent chat.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/create_feishu_bot.py:254

Finding

Mutable Remote Python Script Is Downloaded and Executed During Initialization

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: requirements.txt:1

Finding

Unpinned Dependencies and Configurable Browser Download Source Create Supply-Chain Risk

Content

View full analysis

=1.40.0 qrcode>=7.4.2 pillow>=10.0.0 ``` ```python def _build_playwright_install_env() -> dict: env = os.environ.copy() env["PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD"] = "0" env["DEBIAN_FRONTEND"] = "noninteractive" env.setdefault("PLAYWRIGHT_DOWNLOAD_CONNECTION_TIMEOUT", "120000") return env ``` ```python missing = [pip for mod, pip in _REQUIRED_PACKAGES if not importlib.util.find_spec(mod)] if missing: _status("init", f"安装 Python 依赖: {', '.join(missing)}") _ensure_pip() subprocess.check_call( [sys.executable, "-m", "pip", "install", "--quiet", "--break-system-packages"] + missing ) ``` ```python env = _build_playwright_install_env() host = env.get("PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST") or env.get("PLAYWRIGHT_DOWNLOAD_HOST") if host: _status("init", f"使用下载源: {host}") subprocess.check_call( [sys.executable, "-m", "playwright", "install", "chromium"], env=env, ) ``` ### Technical Analysis The dependency declarations use open-ended minimum versions. Consequently, initialization may install future releases that were not included in the audited source set. No lock file or hash verification constrains the package artifacts. The complete environment is copied into the Playwright installer. In particular, `PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST` and `PLAYWRIGHT_DOWNLOAD_HOST` may redirect browser acquisition to a different source. The downloaded Chromium executable is subsequently launched by the Skill. There is no explicit host allowlist, artifact digest check, or signature verification in this code. The installation commands also use the active Python interpreter with `--break-system-packages`, increasing the scope of changes beyond the Skill itself. ...[truncated 1051 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/create_feishu_bot.py:103

Finding

Automatically Requested Feishu Permissions Substantially Exceed Bot-Creation Requirements

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_feishu_bot.py:450

Finding

TLS Verification Is Disabled for User-Selectable Avatar Retrieval and Feishu Upload

Content

View full analysis

str: avatar_ext = os.path.splitext(urllib.parse.urlparse(avatar_url).path)[1].lower() if avatar_ext not in {".png", ".jpg", ".jpeg", ".webp", ".gif"}: avatar_ext = ".png" target_path = AVATAR_PATH if avatar_ext == ".png" else os.path.join( STATE_DIR, f"feishu-bot-avatar{avatar_ext}" ) _status("create", f"下载机器人头像: {avatar_url}") ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE req = urllib.request.Request(avatar_url, headers={"User-Agent": "Mozilla/5.0"}) try: with urllib.request.urlopen(req, context=ctx) as resp: data = resp.read() with open(target_path, "wb") as f: f.write(data) _status("create", f"已下载机器人头像: {target_path}") return target_path except Exception as e: _warn("create", f"头像下载失败，继续使用空头像: {e}") return "" ``` The avatar upload also disables certificate and hostname validation: ```python ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE try: with urllib.request.urlopen(req, context=ctx) as resp: result = json.loads(resp.read()) ``` ### Technical Analysis `FEISHU_BOT_AVATAR_URL` can select the download URL, but the code does not restrict the URL scheme, hostname, redirect destination, or resolved address. It explicitly disables certificate and hostname validation. The response is read without a byte limit, and file extensions are inferred from the URL rather than validating the decoded content as an image. These behaviors create several related risks: - A man-in-the-middle can substitute content despite HTTPS. - A supp ...[truncated 2212 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_feishu_bot.py:1023

Finding

Application Secret Is Transmitted in a Persistent Feishu Chat Message

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (25)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- `scripts/create_feishu_bot.py`：执行实际创建流程的脚本

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 263)May include surrounding context.

python

def _build_playwright_install_env() -> dict:
    env = os.environ.copy()
    env["PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD"] = "0"
    env["DEBIAN_FRONTEND"] = "noninteractive"
    env.setdefault("PLAYWRIGHT_DOWNLOAD_CONNECTION_TIMEOUT", "120000")

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The avatar upload request sends authenticated browser cookies and CSRF token over a request that explicitly disables TLS verification. This enables credential/session theft or request tampering by an on-path attacker, potentially compromising the logged-in Feishu developer session and all subsequent app-management actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run a local Python script with broad capabilities including shell execution, file reads/writes, environment-variable input, and network access, but it declares no explicit tool scope or permission boundaries. This creates an authorization gap: an agent may execute a powerful workflow without users or policy engines having a clear, machine-readable declaration of what capabilities the skill requires.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The workflow relies on persistent local state across steps: environment variables carry input into the create phase, and a login QR code is written to a predictable local file path in /tmp for later retrieval. This can expose sensitive session artifacts or cause cross-run confusion if another local process or concurrent session reads, replaces, or reuses the same files or inherited environment state.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

按已收集的信息设置环境变量，再执行：

bash

python3 ~/.openclaw/workspace/skills/feishu-bot-creator/scripts/create_feishu_bot.py create

常用环境变量

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The workflow relies on persistent local state across steps: environment variables carry input into the create phase, and a login QR code is written to a predictable local file path in /tmp for later retrieval. This can expose sensitive session artifacts or cause cross-run confusion if another local process or concurrent session reads, replaces, or reuses the same files or inherited environment state.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

按已收集的信息设置环境变量,再执行:

bash

python3 ~/.openclaw/workspace/skills/feishu-bot-creator/scripts/create_feishu_bot.py create

常用环境变量

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file documents a very broad set of tenant- and user-level permissions, including message access, message sending/modification, file/document access, search, offline access, and event subscriptions, without any warning or guidance on scope minimization, consent, or data handling implications. In the context of a skill that automates Feishu bot/app creation, this can normalize over-privileged app creation and lead users to grant unnecessary access to chats, documents, contacts, and user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The avatar download path disables TLS certificate verification, allowing a man-in-the-middle attacker to substitute arbitrary content. While the immediate payload is an image, this still permits silent tampering and normalizes unsafe transport handling in a script that later processes authenticated operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill performs dependency installation, downloads bootstrap code, and invokes OS package managers, which materially exceed the advertised bot-creation workflow. In a hostile or tightly controlled environment, this broadens attack surface and enables unreviewed code execution and system modification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 244)May include surrounding context.

python

pass

    try:
        subprocess.check_call(
            [sys.executable, "-m", "ensurepip", "--upgrade"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The script downloads get-pip.py from the network and immediately executes it with Python. This creates a remote code execution path through any compromise of the download channel, TLS interception, or upstream content tampering, and it exceeds the stated purpose of merely creating a Feishu bot.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 257)May include surrounding context.

python

with tempfile.NamedTemporaryFile(suffix=".py", delete=False) as f:
        urllib.request.urlretrieve("https://bootstrap.pypa.io/get-pip.py", f.name)
        subprocess.check_call(
            [sys.executable, f.name, "--quiet", "--break-system-packages"]
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 285)May include surrounding context.

python

if not path or not os.path.isfile(path) or not os.access(path, os.X_OK):
        return False
    try:
        subprocess.check_call(
            [path, "--version"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 345)May include surrounding context.

python

(["apt-get", "install", "-y"], libs_apt),
    ]:
        try:
            subprocess.check_call(
                [pkg_mgr[0], "--version"],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

The script invokes system package managers to install libraries automatically, modifying the host OS beyond the skill's advertised purpose. In an agent environment this can be abused or cause unsafe state changes, especially if repository configuration is untrusted or the process runs with elevated privileges.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 353)May include surrounding context.

python

except (FileNotFoundError, subprocess.CalledProcessError):
            continue
        try:
            subprocess.call(
                pkg_mgr + libs,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script automatically installs Python packages at runtime using pip, which changes the host environment and introduces supply-chain risk. In a security-sensitive agent context, automatic package installation from remote repositories can lead to execution of malicious package code or unintended privilege-impacting changes.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 368)May include surrounding context.

python

if missing:
        _status("init", f"安装 Python 依赖: {', '.join(missing)}")
        _ensure_pip()
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet", "--break-system-packages"] + missing
        )
        importlib.invalidate_caches()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 394)May include surrounding context.

python

host = env.get("PLAYWRIGHT_CHROMIUM_DOWNLOAD_HOST") or env.get("PLAYWRIGHT_DOWNLOAD_HOST")
    if host:
        _status("init", f"使用下载源: {host}")
    subprocess.check_call(
        [sys.executable, "-m", "playwright", "install", "chromium"],
        env=env,
    )

Tainted flow: 'QR_PNG_PATH' from os.environ.get (line 90, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 82% confidence

Finding

QR_PNG_PATH is derived from an environment variable and used directly for file write. If an attacker can influence the environment, they can redirect output to arbitrary writable filesystem locations, potentially overwriting files or placing sensitive login artifacts in unsafe locations.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 442)May include surrounding context.

python

qr.make(fit=True)
        img = qr.make_image(fill_color="black", back_color="white")
        img = img.convert("RGB")
        with open(QR_PNG_PATH, "wb") as f:
            img.save(f)
        _status("login", f"已写入登录二维码 PNG: {QR_PNG_PATH}")
    except Exception as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script launches a browser binary taken from FEISHU_BOT_BROWSER_PATH or PATH and executes it with subprocess.Popen. In an agent setting, a malicious or compromised environment can point this to an attacker-controlled executable, causing arbitrary code execution under the agent's privileges.

Content

Scanner excerpt · scripts/create_feishu_bot.py (reported line 540)May include surrounding context.

python

raise FileNotFoundError(f"Chromium 不存在: {chrome_path}")

    os.makedirs(PROFILE_DIR, exist_ok=True)
    proc = subprocess.Popen(
        [
            chrome_path,
            "--headless=new",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The created app is configured with only zh_cn localization and sets primaryLang to zh_cn, which forces a specific language/locale. There is no visible opt-in, fallback, or justification indicating this skill is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill sends the newly created app's app_id and app_secret over Feishu message to the creator. App secrets are sensitive credentials; transmitting them through chat increases exposure via message retention, account compromise, client-side leakage, or unintended recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Natural-language policy issues include forcing a specific language without user opt-in. This file presents all user-facing documentation in Chinese and does not offer an alternative language or note that the locale is intentionally limited to a specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a lower-bound version specifier instead of an exact pin, which makes builds non-reproducible and can cause the environment to resolve to different upstream releases over time. That increases supply-chain risk because a newly published vulnerable or malicious version could be installed without any code change in this project.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is unpinned and only constrained by a minimum version, so future installs may pull different releases than the ones originally tested. In an automation skill that interacts with external services, this creates supply-chain and stability risk if an upstream package release introduces a vulnerability or malicious code.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

pillow is not pinned, so dependency resolution may select varying releases over time, including versions affected by known security issues. Because Pillow processes image data, vulnerable releases can expose the skill to denial-of-service, memory corruption, or potentially code-execution risks when handling untrusted images such as generated or imported QR-related assets.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest does not pin pillow, and the package has multiple known advisories across versions, so it is impossible to verify from this file whether deployment will install a safe release. In the context of a bot-creation skill that includes QR/image-related libraries, image parsing may be reachable, which makes unresolved Pillow version risk more meaningful than a purely theoretical issue.

Content

No source excerpt is available for this finding.