ClawHub
Back to skill

Security audit

Feishu File Manager

Security checks for vulnerabilities and agentic risk

Overview

This Feishu file skill matches its general purpose, but needs review because it uses local app secrets and broad/write-capable Feishu permissions for a mostly read/download workflow.

Review before installing. Use a dedicated least-privilege Feishu app, remove write and broad scopes unless explicitly needed, only access files the user specifically identifies and is authorized to retrieve, and ensure app secrets, tenant tokens, and downloaded files are redacted from logs and cleaned up after use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:64
Finding

Excessive Feishu Permissions Violate Least-Privilege Principles

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-94
Vulnerability Type: Excessive cloud API permissions
Risk Level: Medium

Vulnerable Code Snippet

markdown
### 云盘 Drive

| 权限 scope | 说明 |
|-----------|------|
| `drive:drive` | 云盘能力总览 |
| `drive:file` | 文件基础操作 |
| `drive:file:readonly` | 只读文件 |
| `drive:file:download` | 下载文件 |
| `drive:drive:readonly` | 只读云盘元信息 |

### 文档 Docx

| 权限 scope | 说明 |
|-----------|------|
| `docx:document` | 文档基础能力 |
| `docx:document:readonly` | 只读文档内容 |
| `docx:document:write_only` | 写入文档 |

### 表格 Sheets

| 权限 scope | 说明 |
|-----------|------|
| `sheets:spreadsheet` | 表格基础能力 |
| `sheets:spreadsheet:read` | 读取表格 |

### 多维表格 Bitable

| 权限 scope | 说明 |
|-----------|------|
| `bitable:app` | 多维表格应用 |
| `bitable:app:readonly` | 只读多维表格 |

### 知识库 Wiki

| 权限 scope | 说明 |
|-----------|------|
| `wiki:wiki` | 知识库基础 |
| `wiki:node:read` | 读取知识库节点 |

Technical Analysis

The documented workflow obtains a tenant access token, downloads a requested file, and parses its content. That read-oriented workflow does not require write access or broad base scopes for every Feishu service.

The permissions list nevertheless includes broad scopes such as drive:drive, drive:file, docx:document, docx:document:write_only, sheets:spreadsheet, bitable:app, and wiki:wiki. The document labels the section as required permissions and does not distinguish mandatory read-only scopes from optional scopes. In particular, docx:document:write_only is inconsistent with the stated file-reading workflow.

This expands the authority available to the skill and increases the consequences of token disclosure, agent compromise, or accidental misuse.

Attack Path

  1. A user follows the skill's required-permissions section and grants the listed broad and write-capable scopes.
  2. The skill exchanges the Feishu application credentials for a t ...[truncated 1024 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace broad scopes with the smallest read-only scope set needed for the documented workflow.
  • Use drive:file:readonly and drive:file:download where sufficient.
  • Request format-specific read scopes only when the corresponding file type or service is used.
  • Remove docx:document:write_only from the default permission list.
  • Clearly separate mandatory scopes from optional capabilities.
  • Require explicit user authorization before enabling any write operation.
  • Validate the granted scope set at runtime and reject unexpected write or administrative permissions.
  • Use separate Feishu applications or credentials for read-only and write-capable workflows to limit compromise impact.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Feishu Application Secret Exposed Through Shell Command Arguments and History

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: Insecure credential handling
Risk Level: Medium

Vulnerable Code Snippet

bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'

The same credential-passing pattern is repeated in the token-validation example at lines 100-103.

Technical Analysis

The instructions direct the agent to obtain appId and appSecret from the sensitive local file ~/.openclaw/openclaw.json and place the application secret directly in a curl command-line argument.

When executed interactively or through a shell-based tool, the expanded command may be retained in shell history, terminal transcripts, agent execution logs, diagnostics, or command auditing systems. On systems where process arguments are visible to other users or monitoring tools, the request body may also be observable while curl is running.

The application secret is a long-lived credential used to mint tenant access tokens. It is therefore more sensitive than the approximately two-hour token produced by the authentication endpoint.

Attack Path

  1. The agent reads appId and appSecret from ~/.openclaw/openclaw.json.
  2. It substitutes the real values into the documented curl -d argument.
  3. The resulting command is recorded in shell history, an agent tool log, a terminal transcript, process monitoring, or command-auditing output.
  4. A local user, support operator, log reader, or attacker with access to those records recovers the application secret.
  5. The attacker submits the stolen application ID and secret to the official Feishu tenant-token endpoint.
  6. The resulting tenant access token is used to access Feishu resources allowed by the application's granted scopes and sharing configuration.

Impact Assessment

Dis ...[truncated 583 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not interpolate app_secret directly into an interactive shell command.
  • Prefer an official credential-aware Feishu SDK that accepts secrets through protected in-memory configuration.
  • If curl must be used, supply the request body through standard input or a permission-restricted temporary input source rather than a visible command-line argument.
  • Disable command echoing and ensure execution logs redact app_secret, authorization headers, and tenant access tokens.
  • Avoid persisting credential-bearing commands in shell history.
  • Enforce restrictive permissions on ~/.openclaw/openclaw.json, such as owner-only read and write access.
  • Ensure temporary credential material is created atomically, assigned owner-only permissions, and securely deleted immediately after use.
  • Rotate the Feishu application secret if it may already have appeared in command histories or logs.
  • Add automated secret redaction for both the long-lived application secret and generated tenant access tokens.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs reading local credentials from ~/.openclaw/openclaw.json and using them to obtain tenant access tokens, but it provides no warning about handling secrets or the sensitivity of downloaded file contents. Because the skill is designed to access enterprise cloud storage, missing privacy and secret-handling guidance materially raises the risk of credential exposure and unauthorized disclosure of documents.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description is broad enough to trigger on common requests like reading or analyzing files, without clear scoping, consent, or access-control boundaries. In a file-management skill that can obtain tokens and download cloud files, overbroad invocation increases the chance of unintended access to sensitive enterprise documents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

2. 获取 Token

bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

验证 Token 有效性

bash
curl -s 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'

Static analysis

No suspicious patterns detected.