ClawHub

feishu-card-sender

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Feishu card-message helper, but users should handle the Feishu app secret carefully.

Install only if you intend to let the agent send Feishu messages with your app identity. Use a least-privileged Feishu app with only the needed message permission, avoid committing or sharing the App Secret in plaintext, prefer environment variables or a secret manager over USER.md, rotate the secret if exposed, and review recipients, card content, and image paths before sending.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill requires environment-stored Feishu credentials and instructs use of a network-capable upload script, but it does not declare those capabilities or permissions explicitly. This weakens transparency and reviewability, making it easier for a skill to access secrets and make outbound requests without users understanding the full trust boundary.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill asks users to supply a Feishu App ID and App Secret but provides no guidance on secure storage, least privilege, rotation, or the privacy implications of sending message content and images to a third-party service. This increases the risk of credential mishandling, accidental disclosure, and unintentional transmission of sensitive business data to Feishu.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal