T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:152- Finding
Feishu App Secret Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Feishu Bot Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it should be reviewed because it handles app secrets through command-line arguments, creates a backup even during dry-run, and defaults new bots to broad direct-message access.
Before installing, confirm you are comfortable with the skill modifying `~/.openclaw/openclaw.json`, storing backups that may contain secrets, setting OpenClaw session routing scope, and restarting the Gateway. Avoid putting real App Secrets in command lines where possible, explicitly choose a restrictive DM policy, and do not rely on `--dry-run` as fully no-write in this version.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:225- Finding
New Bot Accounts Default to Unrestricted Direct-Message Access
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs users to handle highly sensitive secrets such as Feishu App Secret and describes configuration changes that likely require environment access, but it does not declare any explicit tool scope or permissions boundaries. This creates a transparency and least-privilege problem: an agent may access environment-backed secrets or configuration channels without the user being clearly warned what capabilities the skill needs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains natural-language descriptions and operational prompts in Chinese, beginning with the header comment and continuing through CLI help and status messages. Because the skill forces a specific language for interaction without user opt-in or documented regional justification, it violates the language/locale policy criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises dry-run as not writing configuration, but it creates a backup file on disk before the dry-run exit path. This is a real filesystem side effect that can violate user expectations, leak the existence/path/timing of configuration changes, and create unnecessary sensitive copies of the main config.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The help text claims dry-run will not write anything, but the implementation still writes a backup file. This mismatch is dangerous because operators may rely on dry-run for side-effect-free validation in automation or sensitive environments, leading to unintended persistence of configuration data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file contains natural-language comments and error strings entirely in Chinese, such as the header comment and multiple validation errors. Because the skill does not indicate that it is region-specific or provide any language opt-in, it may violate the language/locale policy requiring user choice or justified locale constraints.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The package description is written entirely in Chinese ('飞书多账户机器人配置管理 skill，用于新增飞书机器人账户并安全更新 OpenClaw Feishu 路由配置') with no indication that other languages are supported or that the language constraint is intentional. Under the policy, locale-specific language should be optional or clearly justified.
- Content