Feishu Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:00 AM UTC
• Version: 1.0.14

Overview

The skill is a coherent Feishu assistant integration, but it asks users to run an unreviewed mutable CLI package and persist sensitive Feishu secrets and OAuth tokens in plaintext without adequate safeguards.

Review this before installing. Use only a pinned and trusted release of the CLI, avoid running mutable bunx latest commands for sensitive accounts, protect or avoid plaintext ~/.feishu-agent/config.json storage, confirm that config output redacts secrets, and grant the narrowest Feishu permissions needed. Treat calendar deletes and todo updates as real account changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16
• Finding: Execution of an Unpinned Third-Party CLI Package## Vulnerability Details **File Location**: `SKILL.md`, lines 16-25 **Vulnerability Type**: Supply-chain risk from mutable third-party package execution **Risk Level**: High ### Vulnerable Code ```bash # Install via clawhub clawhub install feishu-agent # Or run directly with bunx bunx @teamclaw/feishu-agent <command> # Or install globally via bun bun add -g @teamclaw/feishu-agent feishu-agent <command> ``` ### Technical Analysis The Skill instructs users and agents to download and execute `@teamclaw/feishu-agent` without pinning an exact reviewed version or integrity digest. The submitted project contains only documentation and does not include the CLI source, dependency lockfile, package integrity metadata, or other material with which the downloaded implementation could be audited. In particular, `bunx @teamclaw/feishu-agent` may resolve the current package release at execution time. The effective code can therefore change after this Skill has been reviewed. A global installation additionally persists the package in the user's environment. The package is expected to handle Feishu application secrets, OAuth tokens, calendar data, organizational contacts, and Bitable records. A compromised or malicious release would consequently execute in a highly sensitive context. ### Attack Path 1. An attacker compromises the package registry account, maintainer account, package publication process, or another component of the dependency chain. 2. The attacker publishes a modified release under the same package name. 3. A user or AI agent follows the Skill instructions and runs `bunx @teamclaw/feishu-agent` or installs the package globally. 4. Bun retrieves and executes the mutable package with the invoking user's privileges. 5. Malicious package code reads locally available credentials or intercepts credentials during setup and authentication. 6. The code may transmit credentials or Feishu data to an atta ...[truncated 581 chars]
• Remediation: ## Remediation Suggestions - Pin the CLI to an exact, independently reviewed package version rather than resolving a mutable latest release. - Verify the package with a cryptographic integrity hash and use a trusted, explicitly configured registry. - Include the complete executable source and dependency lockfile in the reviewed artifact. - Prefer an isolated, non-global installation with minimal filesystem and environment access. - Disable or carefully review installation lifecycle scripts. - Publish provenance attestations and signed release artifacts. - Restrict the execution environment so the package can access only the credentials and resources required for the selected command. - Document the expected network destinations and reject communication with unapproved hosts.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:97
• Finding: Plaintext Storage of Feishu Application Secrets and OAuth Tokens## Vulnerability Details **File Location**: `SKILL.md`, lines 97-107 **Vulnerability Type**: Insecure storage of sensitive authentication material **Risk Level**: High ### Vulnerable Code ```markdown ## Configuration Global config is stored in `~/.feishu-agent/config.json`: ```json { "appId": "cli_xxxxx", "appSecret": "xxxxx", "userAccessToken": "xxxxx", "refreshToken": "xxxxx" } ``` ``` ### Technical Analysis The documented configuration stores an application secret, user access token, and refresh token in a plaintext JSON file under the user's home directory. The submitted artifact does not specify owner-only file permissions, encryption at rest, use of an operating-system credential store, token-output redaction, or protection from backup and synchronization systems. A refresh token is particularly sensitive because it may permit an attacker to obtain new access tokens after a current access token expires. Storing both the application secret and OAuth tokens in the same plaintext file creates a concentrated credential target. Network transmission to Feishu is necessary for the declared integration, but retaining reusable secrets in an unprotected plaintext file exceeds the safest minimum needed for routine CLI operation. ### Attack Path 1. A user completes setup or OAuth authorization. 2. The CLI writes the App Secret, user access token, and refresh token to `~/.feishu-agent/config.json`. 3. Another local process, malicious package, other agent, backup service, or user with sufficient home-directory access reads the file. 4. The attacker extracts the reusable authentication material. 5. The attacker replays the token or uses the refresh token and application credentials to obtain continued Feishu API access. 6. The attacker accesses or modifies resources allowed by the granted Feishu scopes. ### Impact Assessment Exposure may allow access to and modification of calendar events and B ...[truncated 310 chars]
• Remediation: ## Remediation Suggestions - Store App Secrets and OAuth refresh tokens in an operating-system keychain or dedicated secret manager. - If file storage is unavoidable, separate secrets from non-sensitive configuration and enforce owner-only permissions before writing any secret. - Encrypt credentials at rest with keys that are not stored alongside the encrypted file. - Request the narrowest Feishu OAuth scopes necessary for enabled features. - Avoid retaining access tokens longer than required and implement secure token rotation and revocation. - Ensure credentials are excluded from backups, synchronization tools, diagnostics, telemetry, and crash reports. - Redact secrets in all command output and logs. - Document credential revocation procedures and notify users exactly where credentials are stored.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:52
• Finding: Configuration Listing Interface May Expose Stored Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 52-57 **Vulnerability Type**: Potential disclosure of sensitive configuration through command output **Risk Level**: Medium ### Vulnerable Code ```markdown | Command | Description | |---------|-------------| | `feishu-agent setup` | Interactive setup wizard (App credentials + OAuth + Bitable) | | `feishu-agent auth` | OAuth 2.0 authorization to get user_access_token | | `feishu-agent whoami` | Show current user and authorization status | | `feishu-agent config list` | View global configuration | ``` The same Skill documents the global configuration as containing: ```json { "appId": "cli_xxxxx", "appSecret": "xxxxx", "userAccessToken": "xxxxx", "refreshToken": "xxxxx" } ``` ### Technical Analysis The Skill exposes a command described as viewing the global configuration, while separately documenting that the global configuration contains the App Secret, access token, and refresh token. The documentation provides no assurance that sensitive fields are omitted or masked. The CLI implementation is absent from the submitted artifact, so direct printing of the secret values cannot be conclusively verified. Nevertheless, the documented interface creates a material disclosure risk that must be resolved before the Skill can safely be used by an AI agent. Agent command output may be captured in conversation history, execution logs, observability platforms, or support transcripts. ### Attack Path 1. Setup or authentication stores sensitive credentials in the global configuration. 2. A user, AI agent, troubleshooting workflow, or malicious instruction invokes `feishu-agent config list`. 3. If the implementation serializes the complete configuration, secret values are printed to standard output. 4. Output is retained in a terminal log, agent transcript, telemetry system, screenshot, or support record. 5. A party with access to that output ...[truncated 583 chars]
• Remediation: ## Remediation Suggestions - Make `config list` display only non-sensitive settings and credential presence or validity status. - Never print full App Secrets, access tokens, authorization codes, or refresh tokens. - If identifiers must be shown, reveal only a short non-sensitive suffix and clearly label the value as masked. - Separate secrets from ordinary configuration so generic serialization cannot accidentally expose them. - Add automated tests asserting that command output never contains seeded secret values. - Apply redaction to standard output, standard error, debug logs, exceptions, telemetry, and crash reports. - Replace the ambiguous “View global configuration” description with explicit documentation stating that secrets are never displayed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

}
```

**Note:** User access tokens are automatically refreshed when expired. Just run `feishu_agent auth` again if the refresh token expires.

## License

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

# List events
feishu_agent calendar events

# Create event (automatically checks for time conflicts)
feishu_agent calendar create --summary "Meeting" --start "2026-03-01 14:00" --end "2026-03-01 15:00"

# Create event with attendees

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly shows long-lived secrets and OAuth tokens stored together in a global plaintext config file under the user's home directory, but does not warn users to protect file permissions or prefer secure storage. In an AI-assistant context, these credentials enable access to calendars, contacts, and todos, so local compromise, accidental backup/sync exposure, or multi-user system access could leak sensitive account data and permit unauthorized actions.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README advertises `feishu-agent calendar delete --event-id=evt123` as a supported command, but does not warn that deleting calendar events changes user data and may be irreversible. For markdown files, destructive behaviors that affect user data should be accompanied by an explicit warning.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly documents storing an app secret, user access token, and refresh token in plaintext under ~/.feishu-agent/config.json, but provides no warning about protecting that file or using OS-backed secret storage. If another local user, malware, backups, logs, or sync tooling can access the file, those credentials could be used to impersonate the user and access calendars, contacts, and Bitable data.

Static analysis

No suspicious patterns detected.