Feishu Backup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:20 AM UTC
• Version: 1.0.0

Overview

This Feishu backup skill mostly matches its stated purpose, but it runs helper code outside the reviewed package while handling potentially sensitive chat files.

Review this before installing. It is intended to copy real Feishu chat files into ~/.openclaw/doc/backup, so use it only for files you are allowed to store locally. Also verify and trust the sibling shared helper files before running it, because they are outside this reviewed artifact but are executed by the backup script.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: feishu_backup.sh:17

Finding

Execution of Unbundled and Unverified External Dependencies

Content

View full analysis

Vulnerability Details

File Location: feishu_backup.sh, lines 17–24
Vulnerability Type: Execution of external local dependencies without integrity verification
Risk Level: High

Vulnerable Code

bash

DOWNLOADER="$SCRIPT_DIR/../shared/feishu_downloader.py"
BACKUP_DIR="${BACKUP_DIR:-$HOME/.openclaw/doc/backup}"

mkdir -p "$BACKUP_DIR"

source "$SCRIPT_DIR/../shared/feishu_args.sh"

python3 "$DOWNLOADER" "${FEISHU_ARGS[@]}" "$BACKUP_DIR"

Technical Analysis

The script relies on ../shared/feishu_args.sh and ../shared/feishu_downloader.py, neither of which is included in the audited project. Their behavior and integrity therefore cannot be established from the reviewed package.

The source command executes the entire contents of feishu_args.sh in the current shell process. It is not limited to defining FEISHU_ARGS; the dependency can run arbitrary shell commands and modify variables or process state. The subsequent Python invocation similarly executes the unverified feishu_downloader.py.

No cryptographic hash, trusted ownership check, permission validation, canonical-path restriction, or symlink rejection occurs before execution. Consequently, project review and integrity controls over the two packaged files do not cover the code that implements the effective backup operation.

Attack Path

1. An attacker obtains write access to the expected sibling shared directory, replaces one of the referenced files, or redirects it through a malicious symlink.
2. The attacker places arbitrary shell commands in feishu_args.sh or arbitrary Python code in feishu_downloader.py.
3. A user or AI agent invokes feishu_backup.sh for a legitimate Feishu backup operation.
4. The script sources or executes the attacker-controlled dependency without verifying its identity or integrity.
5. The malicious code runs with the invoking user's privileges and inherits the script's environment and avail ...[truncated 877 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle feishu_args.sh and feishu_downloader.py inside the reviewed skill package rather than resolving them from a sibling directory.
2. Resolve every executable dependency to a canonical path and verify that it remains beneath an approved, immutable skill directory.
3. Reject symbolic links and files with unexpected ownership or group/world-writable permissions.
4. Pin and verify cryptographic hashes or signed manifests for executable dependencies before loading them.
5. Avoid sourcing an external shell file. Parse declarative configuration as data or invoke a narrowly scoped helper process instead.
6. Execute the downloader with a minimal environment and only the filesystem and network permissions required for the backup operation.
7. Include all effective runtime dependencies in future security reviews and release artifacts.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger description uses broad, natural-language examples like 'back up the file from Feishu' and 'save the Feishu file locally' without strong activation boundaries or disambiguation requirements. This can cause the skill to activate in situations the user did not intend, leading to unintended download of chat files to local storage and possible exposure of sensitive documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code creates a backup directory and invokes a downloader to save Feishu group chat files there, which is a file-write operation affecting user data. While the header comments describe usage, they do not clearly warn that chat attachments will be stored locally under a persistent backup path, and there is no runtime disclosure, prompt, or confirmation in the script itself.

Content

No source excerpt is available for this finding.