feishu-api-cache-fix

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:33 PM UTC
• Version: 1.0.0

Overview

The skill appears intended to reduce Feishu API usage, but it asks users to run a root-level script that permanently patches an installed OpenClaw source file with limited safety checks.

Install only if you are comfortable with a third-party script modifying your system-wide OpenClaw installation as root. Review the script first, confirm the target OpenClaw version and path, keep a separate backup, and prefer an official OpenClaw update or versioned patch if available.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: fix_feishu_cache.sh:5

Finding

Privileged and Unsafe Replacement of Globally Installed OpenClaw Source Code

Content

View full analysis

"$PROBE_FILE" << 'EOF' ``` ### Technical Analysis Executing the complete script with `sudo` grants every command in the script unrestricted root privileges, although the legitimate task only requires narrowly scoped permission to update one installed file. The replacement operation is not implemented defensively: - The script does not use `set -euo pipefail`, so it may continue after a failed backup. - It does not verify that the target exists, is a regular file, and is not a symbolic link. - It does not check whether the installed OpenClaw version is compatible with the replacement source. - It overwrites any existing `.bak` file, potentially destroying the last usable backup. - It writes directly to the destination rather than validating a temporary file and atomically installing it. - It does not validate the resulting TypeScript file before reporting success. - It asks the user to trust and run the entire package script as root rather than applying only the necessary operation with elevated privileges. No evidence was found that the current script intentionally executes an external payload, exfiltrates information, establishes persistence, or contains hidden malicious behavior. The vulnerability arises from excessive privilege and unsafe file replacement practices. ### Attack Path 1. A user follows the instruction in `SKILL.md:21` and runs the bundled shell script with `sudo`. 2. ...[truncated 1695 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to run a sudo-enabled shell script that modifies the system, but it provides no explanation of what the script changes, no warning about privileged execution, and no guidance to inspect the script before running it. In a skill distribution context, this creates a social-engineering path for arbitrary privileged code execution if the bundled script is malicious, tampered with, or overly broad.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The markdown explicitly tells the user to run sudo bash fix_feishu_cache.sh, which grants the script full root privileges. Because the skill content does not justify the need for elevation or constrain the script's behavior, any unsafe or hidden command in that script would execute with complete system access, making this especially dangerous in a third-party skill package.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

bash

 运行修复脚本
# 1.sudo bash fix_feishu_cache.sh

# 2. 重启OpenClaw
# 点击菜单栏OpenClaw图标 → Restart

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script presents itself as a simple cache-fix helper, but it actually replaces an installed source file under /usr/local/lib/node_modules in place. That mismatch is security-relevant because it causes code tampering in a system-managed package, making review, rollback, and integrity tracking harder than the description suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script overwrites a file in a global installation path without an explicit warning, review step, or user confirmation. In a skill context, this is more dangerous because it modifies runtime behavior of installed software outside normal package-management controls, which can introduce persistence, break updates, or hide unexpected logic changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The generated TypeScript code handles appId and appSecret credentials and performs logic based on their presence, but the shell script does not warn users that it is patching credential-related probe behavior. For safety-sensitive changes involving credential paths, some disclosure is expected so users understand the impact of the patch.

Content

No source excerpt is available for this finding.