Security audit

Feishu Print

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to print Feishu files, but it relies on unreviewed code outside the package and includes broad printer-management commands that can affect other print jobs.

Review this skill before installing. It may be reasonable for a controlled single-user printer setup, but only if the missing shared Feishu downloader components are trusted and installed from a known source. Avoid using the blanket cancel command, and prefer a version that limits printer management, cleans up downloaded or temporary files, and packages all executable code inside the reviewed skill.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: feishu_fetch_and_print.sh:16
Finding: Execution of Unverified Code from Outside the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `feishu_fetch_and_print.sh`, lines 16–36 **Vulnerability Type**: Unverified external script sourcing and execution **Risk Level**: High ### Vulnerable Code ```bash DOWNLOADER="$SCRIPT_DIR/../shared/feishu_downloader.py" INBOUND_DIR="${INBOUND_DIR:-$HOME/.openclaw/media/inbound}" PRINTER="${PRINTER:-}" mkdir -p "$INBOUND_DIR" if [ -z "$PRINTER" ]; then echo "Error: set the PRINTER environment variable to specify a printer, e.g.: PRINTER=MyPrinter ./feishu_fetch_and_print.sh" echo "Available printers: $(lpstat -a 2>/dev/null | awk '{print $1}' | tr '\n' ' ')" exit 1 fi source "$SCRIPT_DIR/../shared/feishu_args.sh" # Download files and collect successful paths DOWNLOADED=() while IFS= read -r line; do echo "$line" if [[ "$line" == SUCCESS:* ]]; then filepath="${line#SUCCESS: }" DOWNLOADED+=("$filepath") fi done < <(python3 "$DOWNLOADER" "${FEISHU_ARGS[@]}" "$INBOUND_DIR") ``` ### Technical Analysis The script loads two executable components from `../shared`, outside the audited Skill directory: - `feishu_args.sh` is loaded using `source`, causing every command in that file to execute inside the current shell process. - `feishu_downloader.py` is executed directly with Python. Neither component is included in the audited artifact. The Skill does not validate their ownership, permissions, content hashes, signatures, or canonical paths before execution. Consequently, the effective behavior of the Skill depends on mutable, unaudited code outside its package. Using `source` is particularly sensitive because the sourced file can modify shell variables and functions, change shell behavior, read inherited environment variables, or execute arbitrary commands. The downloader similarly runs with all filesystem, network, credential, and device access available to the user invoking the Skill. Although the declared functionality legitimately requires communication with Feishu ...[truncated 1692 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Package all required executable components inside the Skill so that the reviewed artifact contains the complete implementation. 2. Avoid `source` for external argument processing. Use a narrow, data-only interface that returns validated values without executing code in the caller’s shell. 3. Resolve dependency paths to canonical locations and reject paths outside an approved Skill directory. 4. Verify dependency ownership and permissions before use. Reject files writable by untrusted users or groups. 5. Pin and verify cryptographic hashes or signatures for executable dependencies before running them. 6. Run the downloader with a restricted environment and only the credentials, filesystem paths, and network permissions required for Feishu retrieval. 7. Validate downloader output before printing: - Require an absolute canonical path. - Confirm that it is a regular, non-symbolic-link file. - Confirm that it remains inside the approved inbound directory. 8. Include the shared downloader and argument-processing files in future security audits. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:64
Finding: Predictable Temporary File Enables Symlink Overwrite and Sensitive Data Retention<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code ```bash cat > /tmp/openclaw_print.txt << 'EOF' content EOF lp -d <PrinterName> /tmp/openclaw_print.txt ``` ### Technical Analysis The documented workflow writes print content to the fixed path `/tmp/openclaw_print.txt`. Shared temporary directories are accessible to other local users, and shell output redirection follows symbolic links. No exclusive creation, ownership verification, restrictive permission setup, or cleanup is performed. An attacker able to create the predictable path before invocation can make it a symbolic link to another file. The redirection then opens the link target for truncation and writing with the invoking user’s permissions. Alternatively, the attacker can point the link at an attacker-readable file and capture the print content. The temporary file is not deleted after submission to `lp`, leaving potentially sensitive printed content on disk. The workflow also conflicts with the Skill’s stated rule not to create or modify files. ### Attack Path 1. A local attacker predicts that the Skill will use `/tmp/openclaw_print.txt`. 2. Before the documented command runs, the attacker creates that path as a symbolic link. 3. The link points either to: - A victim-owned file writable by the invoking account, to cause truncation or overwrite; or - An attacker-readable destination, to capture the content being printed. 4. The Agent follows the documented workflow and executes the `cat` redirection. 5. The shell follows the symbolic link and writes the print content to the attacker-selected target. 6. If no symlink attack occurs, the predictable temporary file can still remain on disk after printing and expose retained content according to its effective permissions. ### Impact Assessment Exploitation may cause: - Disclosure of sensitive text submitted for pri ...[truncated 372 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid creating a temporary file when printing text. Stream the content directly to the print command: ```bash printf '%s\n' "$content" | lp -d "$printer" ``` 2. If a temporary file is required, create it securely with `mktemp`: ```bash tmp_file="$(mktemp)" chmod 600 "$tmp_file" trap 'rm -f -- "$tmp_file"' EXIT printf '%s\n' "$content" > "$tmp_file" lp -d "$printer" -- "$tmp_file" ``` 3. Do not use fixed filenames in shared temporary directories. 4. Use restrictive permissions and delete temporary content immediately after printing. 5. Keep the documentation consistent with the Skill’s file-creation policy. If file creation is required, explicitly document and constrain that permission instead of claiming that no files are created. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrases are broad enough to overlap with generic printing requests and do not clearly require Feishu context. That can cause the skill to activate for unrelated print intents, widening access to its command set and increasing the chance of unintended printing or misuse of auxiliary printer commands.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill’s stated purpose is fetching and printing files from Feishu, but the documentation also enables arbitrary text printing and broader printer operations unrelated to that purpose. This scope expansion increases the chance the agent can be induced to print attacker-controlled content or perform actions outside the user’s expected Feishu-file workflow.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Listing printers, inspecting queues, and canceling jobs grant operational control over the printing environment that is not necessary for printing Feishu-uploaded files. In an agent setting, these extra capabilities can expose environment details and allow disruption of other users’ print jobs, especially because cancellation is destructive.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documented cancel command is destructive and can delete queued print jobs without any stated confirmation requirement or ownership check. In a shared printing environment, an agent following this guidance could disrupt other users’ work or be manipulated into causing denial of service to the print queue.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: The skill declares a strict rule against creating or modifying files, yet later documents a workflow that writes a temporary file in /tmp for multi-line printing. This inconsistency can mislead downstream agents about what behavior is permitted and weaken guardrails intended to limit filesystem side effects.

Static analysis

No suspicious patterns detected.