Feishu Multi Agent Factory

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:46 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches its stated setup purpose, but it handles Feishu secrets and persistent agent instructions in ways that need review before installation.

Install only if you are comfortable with a skill that can rewrite OpenClaw agent configuration, store Feishu app credentials locally, create persistent agent workspaces, expand agent-to-agent access, and restart the gateway. Prefer using config files or a secret manager instead of pasting production secrets into chat or inline command arguments, and review any agent names/descriptions for multiline instructions before running it.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:61

Finding

Feishu Secrets Are Collected Through Chat and Passed in Command-Line Arguments

Content

View full analysis

' ``` ```bash python3 ~/.openclaw/workspace/skills/feishu-multi-agent-factory/scripts/setup_agents.py \ --config '' \ --restart ``` ### Technical Analysis The documented workflow asks users to provide a Feishu App Secret through an ordinary agent conversation. It then instructs the agent to place the complete secret-bearing JSON payload in the `--config` command-line argument. The script masks the secret in its normal output, but output masking does not protect the original input. The full secret may remain in: - Agent conversation history and associated telemetry - Process command-line arguments visible through local process inspection - Shell history if the documented command is executed manually - Automation logs, command traces, or error reports - Audit records maintained by the platform executing the command The alternative `--config-file` option exists in the implementation, but the primary documented procedure uses `--config` and does not require restrictive permissions for a secret-bearing file. ### Attack Path 1. A user supplies a valid Feishu App Secret through the documented conversation workflow. 2. The agent constructs an inline JSON payload containing the complete secret. 3. The payload is passed to `setup_agents.py` through the `--config` process argument. 4. An attacker with access to conversation records, shell history, pr ...[truncated 856 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/setup_agents.py:151

Finding

Untrusted Agent Metadata Is Persisted as Executable Agent Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup_agents.py (reported line 137)May include surrounding context.

python

save_config(cfg)
    print(f"✅ agent '{agent_id}' 已从配置中移除")
    print(f"   ⚠️  工作区目录未删除，请手动确认是否清除:")
    print(f"   rm -rf {OPENCLAW_DIR}/workspace-{agent_id}")
    print(f"   rm -rf {OPENCLAW_DIR}/agents/{agent_id}")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup_agents.py (reported line 138)May include surrounding context.

python

print(f"✅ agent '{agent_id}' 已从配置中移除")
    print(f"   ⚠️  工作区目录未删除，请手动确认是否清除:")
    print(f"   rm -rf {OPENCLAW_DIR}/workspace-{agent_id}")
    print(f"   rm -rf {OPENCLAW_DIR}/agents/{agent_id}")


# ─── 创建单个 agent ───────────────────────────────────────────────────────────

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to perform shell execution and file reads/writes against sensitive local paths such as ~/.openclaw/openclaw.json and agent workspace directories, but it does not declare any tool scope restrictions. That mismatch creates an over-privileged skill surface: if triggered unexpectedly or supplied with maliciously crafted input, the agent may modify local configuration, create files, or restart services without an explicit permission boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description uses broad natural-language activation phrases such as creating or configuring agents, without clearly bounded trigger conditions. In an agent environment, overly broad activation can cause the skill to run in unintended contexts, potentially leading to unauthorized configuration changes or workspace initialization when the user did not explicitly intend to invoke this high-impact setup workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains natural-language instructions and operational messages exclusively in Chinese, including the module docstring and later CLI outputs. Under the policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a skill triggered to add/create agents, configure Feishu, write openclaw.json, and initialize workspaces. This file also exposes a --remove operation that removes agents and related bindings/accounts from configuration, which goes beyond the stated add/create flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill can restart the OpenClaw gateway, which changes service availability and applies configuration immediately. In an agent skill that primarily provisions agents and Feishu channels, bundling a restart operation increases the blast radius of misuse or accidental invocation, especially if the surrounding platform exposes this script to non-admin-triggered workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_agents.py (reported line 301)May include surrounding context.

python

cmd_remove(args.remove, dry_run=args.dry_run)
        if args.restart and not args.dry_run:
            print("\n🔄 重启 gateway...")
            subprocess.run(["openclaw", "gateway", "restart"], check=False)
        return

    # 解析 JSON 输入

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup_agents.py (reported line 350)May include surrounding context.

python

cmd_remove(args.remove, dry_run=args.dry_run)
        if args.restart and not args.dry_run:
            print("\n🔄 重启 gateway...")
            subprocess.run(["openclaw", "gateway", "restart"], check=False)
        return

    # 解析 JSON 输入

Static analysis

No suspicious patterns detected.