Feishu File Upload

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:05 AM UTC
• Version: 1.0.3

Overview

This skill does what it says, but it can send any local file to arbitrary Feishu recipients using stored app credentials and its credential-handling disclosure is inaccurate.

Install only if you are comfortable letting the agent send selected local files through a Feishu app. Use a dedicated least-privilege Feishu app, restrict who can invoke the skill, verify the exact file path and recipient before each run, avoid sensitive directories, and correct the documentation to disclose that app credentials are sent over HTTPS to Feishu's auth endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:98

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

``` 2. Generate and verify cryptographic hashes for the package and its transitive dependencies, such as with a hash-locked requirements file: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a trusted, explicitly configured package index or an internally controlled package mirror. 4. Periodically update the lock file after reviewing security advisories and dependency changes. 5. Recommend installation in a dedicated virtual environment with only the permissions needed to execute this Skill. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:190

Finding

Misleading Claim That Credentials Are Not Transmitted

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

This skill is designed to access sensitive credentials from ~/.openclaw/openclaw.json and use them to authenticate to a third-party service. In the context of an agent skill, credential access is dangerous because compromise, misuse, or over-broad invocation could let the agent act as the Feishu app and send data externally.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

## How It Works

1. **Read credentials** from `~/.openclaw/openclaw.json` (channels.feishu.appId/appSecret)
2. **Get tenant access token** from Feishu Auth API
3. **Upload file** to Feishu Drive → returns `file_key`
4. **Send file message** using `file_key` to target chat/user

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 93% confidence

Finding

The core function of the skill is exfiltration-capable: it can upload local files and send them to chats, users, or email-backed recipients on Feishu using stored credentials. Although this is the intended business purpose, in an agent environment it materially increases the risk of unauthorized data disclosure if triggered on sensitive local files or attacker-chosen recipients.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

- OR `im:resource` - Read and upload files

**Required for sending messages:**
- `im:message` - Send messages to chats

### How to Enable Permissions

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 46)May include surrounding context.

python

}

def get_tenant_access_token(app_id, app_secret):
    """Get tenant access token from Feishu API"""
    url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    payload = {
        "app_id": app_id,

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 122)May include surrounding context.

python

Args:
        receive_id: The recipient ID (chat_id, open_id, user_id, or email)
        file_key: File key from upload
        token: Access token
        file_name: Original file name
        receive_id_type: Type of receive_id (chat_id, open_id, user_id, email)
    """

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

At this point the script retrieves and uses stored Feishu credentials without any secondary authorization or user-consent barrier beyond invocation. In an agent-skill context, that increases risk because any workflow able to call the skill can leverage resident credentials to access organizational messaging APIs and transmit data externally.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 208)May include surrounding context.

python

sys.exit(1)
    
    # Get token
    print("Getting access token...")
    token = get_tenant_access_token(config["app_id"], config["app_secret"])
    
    # Upload file

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill explicitly requires environment access and performs outbound network operations to Feishu, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent may invoke a credential-reading, file-uploading skill without a clear least-privilege boundary or user-visible approval model.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security note is inaccurate: the documented flow says the skill reads app_id/app_secret locally and then uses them to obtain a tenant token from Feishu, which necessarily transmits credential material to a remote service. Misstating this can mislead operators about data flows and trust boundaries, causing unsafe deployment decisions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code transmits app_id and app_secret from a local credential store to an external Feishu endpoint to obtain an access token. In context this is expected functionality, but it is still a real security-sensitive external transmission because compromise, misuse of the skill, or redirection of execution could expose privileged credentials and enable unauthorized Feishu API access.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 52)May include surrounding context.

python

"app_id": app_id,
        "app_secret": app_secret
    }
    resp = requests.post(url, json=payload)
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") != 0:

Tainted flow: 'data' from requests.post (line 146, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 106)May include surrounding context.

python

"file_type": file_type,
            "file_name": file_name
        }
        resp = requests.post(url, headers=headers, data=data, files=files)
    
    resp.raise_for_status()
    data = resp.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This sends a file message to an external Feishu recipient, completing exfiltration of a local file selected on the command line. In a skill whose purpose is file upload, this is intended behavior, but in an agent setting it is dangerous because the script can transfer potentially sensitive local data to arbitrary chat IDs, user IDs, or email recipients with no allowlist, policy check, or confirmation of recipient legitimacy.

Content

Scanner excerpt · scripts/upload_to_feishu.py (reported line 144)May include surrounding context.

python

"content": json.dumps(content)
    }
    
    resp = requests.post(url, headers=headers, json=payload)
    resp.raise_for_status()
    data = resp.json()