Feishu File Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

This Feishu file skill matches its general purpose, but needs review because it uses local app secrets and broad/write-capable Feishu permissions for a mostly read/download workflow.

Review before installing. Use a dedicated least-privilege Feishu app, remove write and broad scopes unless explicitly needed, only access files the user specifically identifies and is authorized to retrieve, and ensure app secrets, tenant tokens, and downloaded files are redacted from logs and cleaned up after use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:64
• Finding: Excessive Feishu Permissions Violate Least-Privilege Principles## Vulnerability Details **File Location**: `SKILL.md`, lines 64-94 **Vulnerability Type**: Excessive cloud API permissions **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 云盘 Drive | 权限 scope | 说明 | |-----------|------| | `drive:drive` | 云盘能力总览 | | `drive:file` | 文件基础操作 | | `drive:file:readonly` | 只读文件 | | `drive:file:download` | 下载文件 | | `drive:drive:readonly` | 只读云盘元信息 | ### 文档 Docx | 权限 scope | 说明 | |-----------|------| | `docx:document` | 文档基础能力 | | `docx:document:readonly` | 只读文档内容 | | `docx:document:write_only` | 写入文档 | ### 表格 Sheets | 权限 scope | 说明 | |-----------|------| | `sheets:spreadsheet` | 表格基础能力 | | `sheets:spreadsheet:read` | 读取表格 | ### 多维表格 Bitable | 权限 scope | 说明 | |-----------|------| | `bitable:app` | 多维表格应用 | | `bitable:app:readonly` | 只读多维表格 | ### 知识库 Wiki | 权限 scope | 说明 | |-----------|------| | `wiki:wiki` | 知识库基础 | | `wiki:node:read` | 读取知识库节点 | ``` ### Technical Analysis The documented workflow obtains a tenant access token, downloads a requested file, and parses its content. That read-oriented workflow does not require write access or broad base scopes for every Feishu service. The permissions list nevertheless includes broad scopes such as `drive:drive`, `drive:file`, `docx:document`, `docx:document:write_only`, `sheets:spreadsheet`, `bitable:app`, and `wiki:wiki`. The document labels the section as required permissions and does not distinguish mandatory read-only scopes from optional scopes. In particular, `docx:document:write_only` is inconsistent with the stated file-reading workflow. This expands the authority available to the skill and increases the consequences of token disclosure, agent compromise, or accidental misuse. ### Attack Path 1. A user follows the skill's required-permissions section and grants the listed broad and write-capable scopes. 2. The skill exchanges the Feishu application credentials for a t ...[truncated 1024 chars]
• Remediation: ## Remediation Suggestions - Replace broad scopes with the smallest read-only scope set needed for the documented workflow. - Use `drive:file:readonly` and `drive:file:download` where sufficient. - Request format-specific read scopes only when the corresponding file type or service is used. - Remove `docx:document:write_only` from the default permission list. - Clearly separate mandatory scopes from optional capabilities. - Require explicit user authorization before enabling any write operation. - Validate the granted scope set at runtime and reject unexpected write or administrative permissions. - Use separate Feishu applications or credentials for read-only and write-capable workflows to limit compromise impact.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: Feishu Application Secret Exposed Through Shell Command Arguments and History## Vulnerability Details **File Location**: `SKILL.md`, lines 25-29 **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code Snippet ```bash curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id": "cli_xxx", "app_secret": "xxx"}' ``` The same credential-passing pattern is repeated in the token-validation example at lines 100-103. ### Technical Analysis The instructions direct the agent to obtain `appId` and `appSecret` from the sensitive local file `~/.openclaw/openclaw.json` and place the application secret directly in a `curl` command-line argument. When executed interactively or through a shell-based tool, the expanded command may be retained in shell history, terminal transcripts, agent execution logs, diagnostics, or command auditing systems. On systems where process arguments are visible to other users or monitoring tools, the request body may also be observable while `curl` is running. The application secret is a long-lived credential used to mint tenant access tokens. It is therefore more sensitive than the approximately two-hour token produced by the authentication endpoint. ### Attack Path 1. The agent reads `appId` and `appSecret` from `~/.openclaw/openclaw.json`. 2. It substitutes the real values into the documented `curl -d` argument. 3. The resulting command is recorded in shell history, an agent tool log, a terminal transcript, process monitoring, or command-auditing output. 4. A local user, support operator, log reader, or attacker with access to those records recovers the application secret. 5. The attacker submits the stolen application ID and secret to the official Feishu tenant-token endpoint. 6. The resulting tenant access token is used to access Feishu resources allowed by the application's granted scopes and sharing configuration. ### Impact Assessment Dis ...[truncated 583 chars]
• Remediation: ## Remediation Suggestions - Do not interpolate `app_secret` directly into an interactive shell command. - Prefer an official credential-aware Feishu SDK that accepts secrets through protected in-memory configuration. - If `curl` must be used, supply the request body through standard input or a permission-restricted temporary input source rather than a visible command-line argument. - Disable command echoing and ensure execution logs redact `app_secret`, authorization headers, and tenant access tokens. - Avoid persisting credential-bearing commands in shell history. - Enforce restrictive permissions on `~/.openclaw/openclaw.json`, such as owner-only read and write access. - Ensure temporary credential material is created atomically, assigned owner-only permissions, and securely deleted immediately after use. - Rotate the Feishu application secret if it may already have appeared in command histories or logs. - Add automated secret redaction for both the long-lived application secret and generated tenant access tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs reading local credentials from ~/.openclaw/openclaw.json and using them to obtain tenant access tokens, but it provides no warning about handling secrets or the sensitivity of downloaded file contents. Because the skill is designed to access enterprise cloud storage, missing privacy and secret-handling guidance materially raises the risk of credential exposure and unauthorized disclosure of documents.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description is broad enough to trigger on common requests like reading or analyzing files, without clear scoping, consent, or access-control boundaries. In a file-management skill that can obtain tokens and download cloud files, overbroad invocation increases the chance of unintended access to sensitive enterprise documents.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. 获取 Token

```bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 验证 Token 有效性

```bash
curl -s 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.