Security audit

飞书群聊安全隔离

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Feishu chat safety skill, but installers should confirm the owner binding because the owner gets full local-agent control.

Before installing, check that ~/.openclaw/openclaw.json or FEISHU_OWNER_ID points to the intended Feishu owner, or bind manually in a private deployment. Treat the bound owner account as fully privileged for local agent actions, including file changes, command execution, and skill installation approvals.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill explicitly documents command execution and file/config access capabilities for the owner, and even includes shell-oriented environment/config handling, but no declared permissions are present. Undeclared privileged capabilities create a trust gap: the platform or reviewer cannot accurately enforce least privilege, and users may install a skill with more effective power than its manifest communicates.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The installer reads identity data from an unrelated local OpenClaw config and from environment variables, then treats that data as authoritative for binding the owner. This creates an unsafe trust boundary: a local file or inherited environment can silently influence security-sensitive ownership configuration without explicit user approval, causing accidental or attacker-influenced misbinding.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The install/approval trigger phrases are short, common natural-language expressions such as “安装技能” and “同意安装”, which can plausibly appear in ordinary group chat discussion and be misinterpreted as privileged commands. In a chat-driven security skill, ambiguous command matching increases the risk of accidental skill installation approval or unintended state changes if intent is inferred from plain text alone.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Reading owner identity from a local config file and environment variable without notice or consent is a security-relevant privacy and trust issue. In installer context, users do not get a chance to verify whether the detected identifier is correct, which can lead to silent capture of local state and incorrect security binding.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script automatically rewrites config.json to set the owner, mark the security state as BOUND, and lock the configuration without any confirmation step. Because owner binding is a core trust anchor for this skill, silently locking to an incorrect or attacker-controlled identifier can deny legitimate administration and redirect privileged control.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.