ClawHub
Back to skill

Security audit

飞书表情回复

Security checks for vulnerabilities and agentic risk

Overview

The skill is related to Feishu emoji reactions, but it deserves review because it encourages automatic chat actions, local learning state, credential-bearing scripts, and unpinned npm installs.

Review before installing in shared or business Feishu workspaces. Use the smallest Feishu app permission, avoid the optional unpinned npm CLI/SDK paths unless you can pin and audit them, keep credentials out of shell history and broad environments, and disable or constrain automatic learning/reaction behavior if users have not explicitly opted in.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:231
Finding

Unpinned Global CLI Installation Creates a Supply-Chain Code Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:231-234
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable Code

bash
npm install -g @larksuite/cli
lark-cli config init

Technical Analysis

The installation instructions retrieve the latest available version of @larksuite/cli from the user's configured npm registry and install it globally. No exact version, lockfile, or package-integrity verification is specified.

npm packages may execute lifecycle scripts during installation. A compromised maintainer account, registry response, package release, or registry configuration could therefore cause arbitrary code to execute with the privileges of the user running the installation. Global installation also exposes the package beyond this Skill's project directory and is not necessary for the declared reaction functionality because the repository already includes a direct HTTPS implementation.

This finding does not indicate that the named package is currently malicious. It identifies an unsafe, mutable dependency acquisition process.

Attack Path

  1. An attacker compromises the upstream package, a maintainer account, or the npm registry path used by the victim.
  2. The attacker publishes or serves a malicious release under the expected package name.
  3. A user follows the Skill instructions and runs npm install -g @larksuite/cli.
  4. npm downloads the mutable latest release and may execute malicious lifecycle scripts.
  5. The installed CLI is subsequently invoked through lark-cli config init, providing another opportunity for attacker-controlled code to run.
  6. The payload executes as the installing user and may access files, environment variables, network resources, and user-level configuration available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the current user's privileges. Th ...[truncated 355 chars]

Remediation
View remediation

Remediation Suggestions

  • Avoid global installation and prefer a project-local dependency.
  • Pin the dependency to an exact, reviewed version rather than accepting the latest release.
  • Declare the dependency in package.json and commit a lockfile with integrity hashes.
  • In documented workflows, use npm ci against the committed lockfile.
  • Verify that the configured registry is the expected trusted registry before installation.
  • Review package provenance, signatures, published contents, and lifecycle scripts before approving upgrades.
  • Prefer the included direct Feishu API implementation when a separate CLI is unnecessary.
  • If the CLI remains optional, clearly warn users that installation executes third-party code with their account privileges.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:243
Finding

Unpinned Feishu SDK Dependency Can Execute Mutable Third-Party Code with Credential Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:243-245; runtime import at scripts/add_reaction_sdk.js:19
Vulnerability Type: Unpinned runtime dependency with access to application credentials
Risk Level: Medium

Vulnerable Code

Installation instruction:

bash
npm install @larksuiteoapi/node-sdk
node scripts/add_reaction_sdk.js om_message_id THUMBSUP

Runtime import:

javascript
const Lark = await import('@larksuiteoapi/node-sdk');

The imported package is subsequently initialized with credentials obtained from the process environment:

javascript
const APP_ID = process.env.FEISHU_APP_ID_INSTANCE2;
const APP_SECRET = process.env.FEISHU_APP_SECRET_INSTANCE2;

const client = new Lark.default.Client({
  appId: APP_ID,
  appSecret: APP_SECRET,
  domain: Lark.default.Domain.Feishu,
});

Technical Analysis

The Skill tells users to install @larksuiteoapi/node-sdk without an exact version or a committed lockfile. The runtime script then dynamically imports whichever package version was resolved into node_modules.

A malicious or compromised dependency can execute code during npm lifecycle hooks and again when the module is imported. During runtime, the Node.js process contains FEISHU_APP_ID_INSTANCE2 and FEISHU_APP_SECRET_INSTANCE2 in its environment. Imported JavaScript executes in the same process and security context as the Skill script, so it can read these credentials directly, modify API behavior, access local files, or transmit data to an external destination.

The package name is consistent with the documented Lark SDK, and the reviewed code does not demonstrate current malicious behavior. The vulnerability is the absence of dependency pinning and artifact verification around code that runs in a credential-bearing process.

Attack Path

  1. An attacker compromises the SDK publisher, an upstream dependency, a registry account, or the registry path ...[truncated 1308 chars]
Remediation
View remediation

Remediation Suggestions

  • Add @larksuiteoapi/node-sdk to package.json at an exact reviewed version.
  • Generate and commit a package lockfile containing integrity hashes.
  • Replace ad hoc npm install instructions with npm ci.
  • Audit the SDK and its transitive dependency tree before updates.
  • Use trusted registry configuration and verify package provenance where supported.
  • Disable dependency lifecycle scripts during installation when they are not required, for example through an appropriately tested --ignore-scripts workflow.
  • Run the SDK script with a minimal environment and avoid exposing unrelated credentials to the process.
  • Ensure the Feishu application retains only im:message.reactions:write_only and remove any unrelated permissions.
  • Prefer the direct API script if avoiding the SDK dependency is practical.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (28)

Scope Creep

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented prerequisite claims only Feishu reaction write permission, yet the skill also describes writing learned emoji data to local storage. This mismatch can mislead operators into granting or approving the skill under a narrower trust assumption while it performs additional stateful behavior that may affect privacy, auditability, and system integrity.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a higher-level behavioral skill involving judgment, interpretation, contextual understanding, and self-learning around Feishu reactions. The actual code is only a low-level utility for adding a reaction to a message when given explicit inputs. While adding Feishu reactions is related to the topic, the implemented functionality is far narrower and lacks the core described capabilities. Therefore the description does not accurately represent what the code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a high-level agent behavior skill with decision-making, reaction interpretation, cultural semantics, and self-learning. The supplied code does none of that. It is only a narrow utility that performs one action: add a given emoji reaction to a given Feishu message when explicitly invoked with parameters. Its primary purpose is materially different from the declared autonomous/interactive skill behavior, and it also includes implementation-specific behavior (hardcoded accountId and local module imports) absent from the description. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description presents a high-level agent behavior system for nuanced emoji-reaction use in Feishu, including judgment, interpretation, cultural semantics, and self-learning. The supplied code only performs one narrow action: adding a specified reaction to a specified message using the Feishu SDK. While this is loosely related to Feishu emoji replies, it does not implement the core declared behaviors. There are no undeclared dangerous capabilities, but the actual functionality is materially narrower and different from the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: feishu-emoji-reaction description: | 让 Agent 学会用飞书表情回复：主动表达情绪、读懂用户 reaction 并回应、自学新表情。包含静默判断（什么时候该回、什么时候闭嘴）、文化语境（SMILE=呵呵、OnIt=在做了）、自学习闭环。

飞书表情回复

让 Agent 学会用表情说话——主动表达、读懂情绪、知道什么时候该回应什么时候该闭嘴。

快速开始

javascript
// 给当前消息加表情
message({
  action: "react",
  channel: "feishu",
  emoji: "THUMBSUP"
})

核心概念

1. 添加表情

用表情回�

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.old.md (reported line 4)May include surrounding context.

name: feishu-emoji-reaction description: | 让 Agent 学会用飞书表情回复：主动表达情绪、读懂用户 reaction 并回应、自学新表情。包含静默判断（什么时候该回、什么时候闭嘴）、文化语境（SMILE=呵呵、OnIt=在做了）、自学习闭环。

飞书表情回复

让 Agent 学会用表情说话——主动表达、读懂情绪、知道什么时候该回应什么时候该闭嘴。

快速开始

javascript
// 给当前消息加表情
message({
  action: "react",
  channel: "feishu",
  emoji: "THUMBSUP"
})

核心概念

1. 添加表情

用表情回�

Self-Modification

High
Category
Rogue Agent
Confidence
97% confidence
Finding

The instruction to 'update this skill' encourages self-modification of the skill's own documentation or behavior based on newly observed user inputs. That creates a classic prompt/policy poisoning channel where adversarial users can influence future agent behavior by causing persistent changes to trusted skill content.

Content

Scanner excerpt · SKILL.old.md (reported line 306)May include surrounding context.

md
2. **Context matters** — Note the situation where users use specific emoji
3. **Keep a vocabulary** — Maintain your learned emoji list in a persistent file
4. **Ask when unsure** — If an emoji's meaning is unclear, ask the user
5. **Update this skill** — If you discover many new emoji, consider updating this documentation

### Example Learning Session

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 24)May include surrounding context.

sh
fi

# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 25)May include surrounding context.

sh
# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{
    \"app_id\": \"$FEISHU_APP_ID_INSTANCE2\",

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

If token acquisition fails, the script prints the full TOKEN_RESPONSE. Authentication error payloads can contain sensitive operational details and, depending on API behavior or proxies, may expose token material or credential-related diagnostics into logs visible to other users or systems. In an agent skill context, log leakage is more dangerous because outputs may be stored, surfaced to users, or forwarded into monitoring pipelines.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 35)May include surrounding context.

sh
TENANT_ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | python3 -c "import sys, json; print(json.load(sys.stdin).get('tenant_access_token', ''))")

if [ -z "$TENANT_ACCESS_TOKEN" ]; then
  echo "错误: 无法获取 access token"
  echo "$TOKEN_RESPONSE"
  exit 1
fi

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 42)May include surrounding context.

sh
# 添加表情回复
echo "正在添加表情回复: $EMOJI_TYPE 到消息 $MESSAGE_ID ..."
REACTION_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages/$MESSAGE_ID/reactions" \
  -H "Authorization: Bearer $TENANT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation presents a culturally specific interpretation of emoji as a default behavior rather than a configurable preference. This can cause the agent to misread user intent and generate inappropriate or socially harmful responses, especially in mixed-language or cross-cultural environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly describes autonomous 'self-learning' that will attempt unknown emoji through the API as soon as they are observed. That creates unintended outbound actions without user confirmation or clear operator awareness, which can surprise users, leak behavioral signals, and cause the agent to perform side effects based on untrusted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The cultural-context table hard-codes Chinese internet-slang meanings as authoritative defaults for multiple emoji. In practice this can systematically bias the agent's responses, leading to misunderstanding, reputational harm, and potentially manipulative behavior if users are interpreted through the wrong cultural lens.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README describes persistent self-learning that stores newly observed emoji mappings into a local memory file, which materially expands the skill's behavior beyond simple message reactions. Persistent writes create an undeclared data retention surface and can capture user-derived content without clear consent, review, or bounds.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description states that it has '中文互联网黑话内置', indicating a built-in Chinese cultural/linguistic interpretation model. This is a locale/language-specific behavior presented as a default capability, with no mention of user choice or opt-in, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents executable shell/CLI/SDK paths and environment-variable based credential use, but does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, that mismatch can cause the runtime or reviewer to underestimate what capabilities the skill may induce the agent to use, increasing the chance of unintended shell access or secret exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill expands from simple message reactions into direct shell, CLI, and Node execution paths with credential handling instructions. In an agent environment, such embedded operational instructions can trigger broader tool usage than expected and expose secrets or enable unintended command execution workflows outside the core skill purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation text is overly broad and can cause the skill to trigger during ordinary conversation whenever users mention likes, emoji, or reactions. In an agent environment with side-effectful tools, this increases the chance of unintended message reactions being sent without clear user intent, creating confusing or unauthorized actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documentation includes Chinese-specific phrasing such as '比 crush 难聊' and later examples and mappings that frame responses in Chinese internet culture. Because the skill does not say this language/cultural behavior is optional or user-selected, it risks forcing a specific language/locale style on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The learned emoji vocabulary and cultural notes map emoji meanings using Chinese phrases such as '无语', '在做了', '懂了', and '呵呵'. This embeds a specific locale and language assumption into the skill's behavior without indicating that the agent should adapt to the user's preferred language.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 25)May include surrounding context.

sh
# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{
    \"app_id\": \"$FEISHU_APP_ID_INSTANCE2\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/add_reaction.sh (reported line 42)May include surrounding context.

sh
# 添加表情回复
echo "正在添加表情回复: $EMOJI_TYPE 到消息 $MESSAGE_ID ..."
REACTION_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages/$MESSAGE_ID/reactions" \
  -H "Authorization: Bearer $TENANT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file's natural-language documentation and runtime user-facing messages are exclusively in Chinese, including the usage instructions. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The documentation instructs users to place app credentials into environment variables and use external APIs without any warning about secret storage, logging, history leakage, or least-privilege practices. While not an exploit by itself, this increases the likelihood of accidental credential exposure in terminals, CI logs, or shared environments.

Content

No source excerpt is available for this finding.