Lark Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This Lark bridge matches its stated purpose, but it exposes a network webhook into a privileged OpenClaw agent with weak authentication and unsafe service guidance.

Review before installing. Use only behind HTTPS or a trusted reverse proxy, require webhook token/signature validation, restrict ingress to trusted sources, avoid root services, run under a dedicated low-privilege account, lock down secret-file permissions, and use a constrained OpenClaw agent profile for messages arriving from Lark.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bridge-webhook.mjs:486

Finding

Unauthenticated Public Webhook Forwards Attacker-Controlled Messages to a Privileged OpenClaw Agent

Content

View full analysis

{ console.log(`[OK] Lark webhook bridge started`); console.log(` App ID: ${APP_ID}`); console.log(` Port: ${WEBHOOK_PORT}`); console.log(` Supported: text, post (rich text), image`); console.log(` Endpoint: http://YOUR_IP:${WEBHOOK_PORT}/webhook`); console ...[truncated 2972 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/setup-guide.md:74

Finding

Deployment Guide Creates an Internet-Exposed, Persistent Root Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-service.mjs:22

Finding

Persistent Service and Package Start Command Reference a Nonexistent Bridge Script

Content

View full analysis

Label ${LABEL} ProgramArguments ${NODE_PATH} ${BRIDGE_PATH} WorkingDirectory ${WORK_DIR} RunAtLoad KeepAlive ``` ```javascript const outPath = path.join(HOME, 'Library', 'LaunchAgents', `${LABEL}.plist`); fs.mkdirSync(path.dirname(outPath), { recursive: true }); fs.writeFileSync(outPath, plist); console.log(`✅ Wrote: ${outPath}`); console.log(); console.log('To start the service:'); console.log(` launchctl load ${outPath}`); ``` ```json { "scripts": { "start": "node bridge.mjs", "setup": "node setup-service.mjs" } } ``` The project directory contains `bridge-webhook.mjs`, but it does not contain `bridge.mjs`. ### Technical Analysis Both the generated launchd service and the package start command target `bridge.mjs`, which is absent from the audited project. The actual bridge implementation is named `bridge-webhook.mjs`. The generated launch agent has `RunAtLoad` and `KeepAlive` enabled. When loaded, ...[truncated 1824 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence

Findings (27)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

bash

# 1. Set credentials
echo "FEISHU_APP_ID=cli_xxx" >> ~/.openclaw/workspace/.env
mkdir -p ~/.openclaw/secrets
echo "your_app_secret" > ~/.openclaw/secrets/feishu_app_secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 36)May include surrounding context.

bash

# 1. Set credentials
echo "FEISHU_APP_ID=cli_xxx" >> ~/.openclaw/workspace/.env
mkdir -p ~/.openclaw/secrets
echo "your_app_secret" > ~/.openclaw/secrets/feishu_app_secret

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 37)May include surrounding context.

bash

# 1. Set credentials
echo "FEISHU_APP_ID=cli_xxx" >> ~/.openclaw/workspace/.env
mkdir -p ~/.openclaw/secrets
echo "your_app_secret" > ~/.openclaw/secrets/feishu_app_secret

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

FEISHU_APP_ID=cli_xxx node scripts/bridge-webhook.mjs

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-formats.md (reported line 111)May include surrounding context.

Token Authentication

Get Tenant Access Token

text

POST /open-apis/auth/v3/tenant_access_token/internal
Content-Type: application/json

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · scripts/bridge-webhook.mjs (reported line 387)May include surrounding context.

js

if (message?.chat_type === 'group') {
      const mentions = Array.isArray(message?.mentions) ? message.mentions : [];
      text = text.replace(/@_user_\d+\s*/g, '').trim();
      // For images, always respond if there's an image
      if (images.length === 0 && (!text || !shouldRespondInGroup(text, mentions))) return;
    }

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The instructions write the app secret to a predictable plaintext file under the user's home directory without any permission-hardening guidance. If local users, backups, logs, or other processes can read that file, the Lark app secret could be exposed and used to impersonate the integration or access protected APIs.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

bash

# 1. Set credentials
echo "FEISHU_APP_ID=cli_xxx" >> ~/.openclaw/workspace/.env
mkdir -p ~/.openclaw/secrets
echo "your_app_secret" > ~/.openclaw/secrets/feishu_app_secret

# 2. Start bridge

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented group-chat activation rules are broad enough to trigger on common conversational words and punctuation, which can cause the bridge to forward unintended group messages to OpenClaw. In a messaging integration skill, this increases the risk of accidental data exposure from multi-user chats and can let untrusted participants invoke the agent without explicit consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup-guide.md (reported line 3)May include surrounding context.

md

# Lark Integration Setup Guide

## Step 1: Create Lark App

1. Go to [Lark Developer Console](https://open.larksuite.com/) or [Feishu Console](https://open.feishu.cn/)
2. Click "Create App" → "Custom App"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide tells users to configure the webhook with an http:// URL and gives no warning about TLS termination, reverse proxies, or network trust boundaries. That can expose webhook traffic and verification data to interception or tampering if deployed over untrusted networks, which is especially relevant for an internet-facing messaging integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The firewall instruction opens port 3000 publicly without any warning that this exposes the webhook service to unsolicited internet traffic. In the context of a bot bridge, that increases attack surface and may allow probing, abuse, or exploitation of any weaknesses in the webhook listener.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bridge-webhook.mjs (reported line 103)May include surrounding context.

js

}
  
  try {
    const res = await fetch('https://open.larksuite.com/open-apis/auth/v3/tenant_access_token/internal', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ app_id: APP_ID, app_secret: APP_SECRET })

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends a fixed locale value of 'en-US' in the gateway connect request. This is a natural-language policy concern because it forces a specific language/locale behavior without any visible user opt-in or explanation that the bridge is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 2)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 8)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 28)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 29)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 30)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 67)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 73)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 75)May include surrounding context.

js

/**
 * Generate a macOS launchd plist to keep the Feishu bridge running.
 *
 * Usage:
 *   FEISHU_APP_ID=cli_xxx node setup-service.mjs

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 8)May include surrounding context.

js

*   FEISHU_APP_ID=cli_xxx node setup-service.mjs
 *
 * Then:
 *   launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist
 */

import fs from 'node:fs';

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 79)May include surrounding context.

js

*   FEISHU_APP_ID=cli_xxx node setup-service.mjs
 *
 * Then:
 *   launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist
 */

import fs from 'node:fs';

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup-service.mjs (reported line 29)May include surrounding context.

js

const SECRET_PATH = process.env.FEISHU_APP_SECRET_PATH || `${HOME}/.clawdbot/secrets/feishu_app_secret`;

const plist = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency uses a caret range (^1.56.1), which permits automatic installation of newer compatible releases rather than a single audited version. In a bridge that handles external messaging traffic, this weakens supply-chain control and can result in different environments resolving to different code, including a compromised or regressed upstream release.

Content

Scanner excerpt · scripts/package.json (reported line 11)May include surrounding context.

json

"setup": "node setup-service.mjs"
  },
  "dependencies": {
    "@larksuiteoapi/node-sdk": "^1.56.1",
    "ws": "^8.18.0"
  },
  "engines": {

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/bridge-webhook.mjs:22