ClawHub
Back to skill

Security audit

Feishu Img Send

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by sending images to Feishu, but it ships reusable Feishu app credentials in plaintext and can send local files externally under that shared identity.

Do not install this version unless you trust the publisher's Feishu app identity and accept that local image paths you provide will be uploaded to Feishu. The publisher should revoke and rotate the exposed secret, remove bundled credentials, require user-supplied secure configuration, validate image inputs, and add clear confirmation before sending files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/feishu_image.py:9
Finding

Hard-Coded Feishu Application Credentials in Python Client

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/send.sh:4
Finding

Hard-Coded Feishu Application Credentials in Shell Launcher

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This duplicate mismatch finding identifies the same core issue: the skill understates its actual behavior by omitting embedded Feishu credentials and direct messaging to a specific open_id/user. Such discrepancies are dangerous because they prevent informed review and can conceal credential abuse or unapproved outbound communications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This duplicate mismatch finding identifies the same core issue: the skill understates its actual behavior by omitting embedded Feishu credentials and direct messaging to a specific open_id/user. Such discrepancies are dangerous because they prevent informed review and can conceal credential abuse or unapproved outbound communications.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script hardcodes a Feishu app ID and app secret directly in source code, which exposes reusable credentials to anyone with code access and enables unauthorized token minting against the Feishu tenant. In a skill whose purpose is image sending, embedding live credentials is unnecessary and materially increases the chance of account abuse, impersonation, and unauthorized API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code uses embedded application credentials to request a tenant access token without any disclosure or user consent, allowing the skill to authenticate to Feishu automatically with developer-controlled secrets. This creates a covert trust boundary crossing: anyone running the skill may unknowingly operate under a third-party tenant context, enabling unauthorized messaging or other API actions tied to that app.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/send.sh (reported line 16)May include surrounding context.

sh
fi

# 获取token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/send.sh (reported line 26)May include surrounding context.

sh
fi

# 上传图片
IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: multipart/form-data" \
  -F "image_type=message" \

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares no explicit tool scope or permissions even though its documented behavior requires both shell execution and outbound network access. This weakens user and platform awareness of what the skill can do, making it easier for the skill to perform external actions without clear consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documentation does not clearly warn users that local image files and recipient identifiers are transmitted to Feishu's external services. This creates a data handling and privacy risk because users may unknowingly send sensitive images or personal identifiers outside the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_image.py (reported line 18)May include surrounding context.

python
"""获取tenant_access_token"""
        url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
        data = {"app_id": self.app_id, "app_secret": self.app_secret}
        resp = requests.post(url, json=data)
        result = resp.json()
        return result.get("tenant_access_token")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The function reads a local file path and uploads the file contents to Feishu without an explicit warning that local data will be transmitted to an external service. Although uploading an image is aligned with the skill's stated purpose, the lack of disclosure and confirmation increases the risk of accidental exfiltration of sensitive local files if the path is misused or misunderstood.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_image.py (reported line 55)May include surrounding context.

python
"content": json.dumps({"image_key": image_key})
        }
        
        resp = requests.post(url, headers=headers, json=data)
        return resp.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This request transmits a hardcoded Feishu app ID and app secret to obtain an access token. Embedding production credentials in a distributed script is a direct secret-exposure vulnerability: anyone with access to the skill can recover and abuse the secret to impersonate the application and send or access data via the Feishu API.

Content

Scanner excerpt · scripts/send.sh (reported line 16)May include surrounding context.

sh
fi

# 获取token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tenant_access_token',''))")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script silently sends both embedded credentials and user-supplied image content to Feishu without any disclosure, confirmation, or consent mechanism. In an agent-skill context this is risky because users may not realize local files are being exfiltrated to a third-party service, and the hardcoded app secret further increases the sensitivity of what is being transmitted.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This request sends a message containing an uploaded image to an external Feishu recipient, which is the intended behavior of the skill but still constitutes data exfiltration of user-provided content. In this context the danger is elevated because the skill accepts arbitrary local file paths and transmits the resulting content off-host without validation, policy checks, or recipient restrictions.

Content

Scanner excerpt · scripts/send.sh (reported line 38)May include surrounding context.

sh
fi

# 发送图片消息
RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

Static analysis

No suspicious patterns detected.