Security audit

Feishu Print

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to print Feishu files, but it relies on unreviewed code outside the package and includes broad printer-management commands that can affect other print jobs.

Review this skill before installing. It may be reasonable for a controlled single-user printer setup, but only if the missing shared Feishu downloader components are trusted and installed from a known source. Avoid using the blanket cancel command, and prefer a version that limits printer management, cleans up downloaded or temporary files, and packages all executable code inside the reviewed skill.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: feishu_fetch_and_print.sh:16
Finding: Execution of Unverified Code from Outside the Skill Package
Content: View full analysis
/dev/null | awk '{print $1}' | tr '\n' ' ')" exit 1 fi source "$SCRIPT_DIR/../shared/feishu_args.sh" # Download files and collect successful paths DOWNLOADED=() while IFS= read -r line; do echo "$line" if [[ "$line" == SUCCESS:* ]]; then filepath="${line#SUCCESS: }" DOWNLOADED+=("$filepath") fi done < <(python3 "$DOWNLOADER" "${FEISHU_ARGS[@]}" "$INBOUND_DIR") ``` ### Technical Analysis The script loads two executable components from `../shared`, outside the audited Skill directory: - `feishu_args.sh` is loaded using `source`, causing every command in that file to execute inside the current shell process. - `feishu_downloader.py` is executed directly with Python. Neither component is included in the audited artifact. The Skill does not validate their ownership, permissions, content hashes, signatures, or canonical paths before execution. Consequently, the effective behavior of the Skill depends on mutable, unaudited code outside its package. Using `source` is particularly sensitive because the sourced file can modify shell variables and functions, change shell behavior, read inherited environment variables, or execute arbitrary commands. The downloader similarly runs with all filesystem, network, credential, and device access available to the user invoking the Skill. Although the declared functionality legitimately requires communication with Feishu ...[truncated 1692 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:64
Finding: Predictable Temporary File Enables Symlink Overwrite and Sensitive Data Retention
Content: View full analysis
/tmp/openclaw_print.txt << 'EOF' content EOF lp -d /tmp/openclaw_print.txt ``` ### Technical Analysis The documented workflow writes print content to the fixed path `/tmp/openclaw_print.txt`. Shared temporary directories are accessible to other local users, and shell output redirection follows symbolic links. No exclusive creation, ownership verification, restrictive permission setup, or cleanup is performed. An attacker able to create the predictable path before invocation can make it a symbolic link to another file. The redirection then opens the link target for truncation and writing with the invoking user’s permissions. Alternatively, the attacker can point the link at an attacker-readable file and capture the print content. The temporary file is not deleted after submission to `lp`, leaving potentially sensitive printed content on disk. The workflow also conflicts with the Skill’s stated rule not to create or modify files. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/openclaw_print.txt`. 2. Before the documented command runs, the attacker creates that path as a symbolic link. 3. The link points either to: - A victim-owned file writable by the invoking account, to cause truncation or overwrite; or - An attacker-readable destination, to capture the content being printed. 4. The Agent follows the documented workflow and executes the `cat` redirection. 5. The shell follows the symbolic link and writes the print content to the attacker-selected target. 6. If no symlink attack occurs, the predictable temporary file can still remain on disk after printing and expose retained content according to its effective permissions. ### Impact Assessment Exploitation may cause: - Disclosure of sensitive text submitted for pri ...[truncated 372 chars]
Remediation: View remediation
"$tmp_file" lp -d "$printer" -- "$tmp_file" ``` 3. Do not use fixed filenames in shared temporary directories. 4. Use restrictive permissions and delete temporary content immediately after printing. 5. Keep the documentation consistent with the Skill’s file-creation policy. If file creation is required, explicitly document and constrain that permission instead of claiming that no files are created. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to overlap with generic printing requests and do not clearly require Feishu context. That can cause the skill to activate for unrelated print intents, widening access to its command set and increasing the chance of unintended printing or misuse of auxiliary printer commands.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s stated purpose is fetching and printing files from Feishu, but the documentation also enables arbitrary text printing and broader printer operations unrelated to that purpose. This scope expansion increases the chance the agent can be induced to print attacker-controlled content or perform actions outside the user’s expected Feishu-file workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Listing printers, inspecting queues, and canceling jobs grant operational control over the printing environment that is not necessary for printing Feishu-uploaded files. In an agent setting, these extra capabilities can expose environment details and allow disruption of other users’ print jobs, especially because cancellation is destructive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented cancel command is destructive and can delete queued print jobs without any stated confirmation requirement or ownership check. In a shared printing environment, an agent following this guidance could disrupt other users’ work or be manipulated into causing denial of service to the print queue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill declares a strict rule against creating or modifying files, yet later documents a workflow that writes a temporary file in /tmp for multi-line printing. This inconsistency can mislead downstream agents about what behavior is permitted and weaken guardrails intended to limit filesystem side effects.
Content: No source excerpt is available for this finding.