ClawHub
Back to skill

Security audit

飞书消息文件下载

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to download Feishu message attachments as advertised, but it needs review because unsafe filenames can write or overwrite files outside the intended folder.

Review or fix the filename handling before installing broadly: reject absolute paths and ../ components, prevent unintended overwrites, and add download timeouts and size limits. Use a narrowly scoped Feishu app secret and run the skill where downloaded files cannot damage important local data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
download.py:280
Finding

Arbitrary File Write Through Unsanitized Download Filename

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
download.py:275
Finding

Unbounded Streaming Download Can Cause Resource Exhaustion

Content
View full analysis
Remediation
View remediation
max_bytes: raise ValueError("Downloaded file exceeds the configured size limit") f.write(chunk) ``` 5. Download into a restricted temporary file and delete it whenever transfer, validation, or rename fails. 6. Consider checking available disk space before large downloads and applying per-user quotas or concurrency limits. 7. Apply timeouts to the token and message-information requests as well, because those calls currently use the same unbounded request pattern. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (16)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: feishu-message-download
description: 从飞书消息中下载文件（视频、图片、文档等）到本地
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["python3"],"python_deps":["requests"]}}}
---

# 飞书消息文件下载

从飞书消息中下载文件（视频、图片、文档等）到本地。

## 描述

本 Skill 用于从飞书聊天消息中下载附件到本地，支持视频、图片、文件等多种类型。

下载后的文件可以用于：
- 视频编辑和处理
- 上传到抖音、小红书、B 站等平台
- 本地存档和备份
- AI 分析和处理
- 转发到其他平台

## �

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 212)May include surrounding context.

md
result = response.json()
            
            if result.get("code") != 0:
                raise Exception(f"获取 access token 失败: {result.get('msg')}")
            
            self._access_token = result["tenant_access_token"]
            return self._access_token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 214)May include surrounding context.

md
result = response.json()
            
            if result.get("code") != 0:
                raise Exception(f"获取 access token 失败: {result.get('msg')}")
            
            self._access_token = result["tenant_access_token"]
            return self._access_token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 242)May include surrounding context.

md
result = response.json()
            
            if result.get("code") != 0:
                raise Exception(f"获取 access token 失败: {result.get('msg')}")
            
            self._access_token = result["tenant_access_token"]
            return self._access_token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · download.py (reported line 138)May include surrounding context.

python
result = response.json()
            
            if result.get("code") != 0:
                raise Exception(f"获取 access token 失败: {result.get('msg')}")
            
            self._access_token = result["tenant_access_token"]
            return self._access_token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · download.py (reported line 143)May include surrounding context.

python
result = response.json()
            
            if result.get("code") != 0:
                raise Exception(f"获取 access token 失败: {result.get('msg')}")
            
            self._access_token = result["tenant_access_token"]
            return self._access_token

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "name": "feishu-message-download",
  "version": "1.0.0",
  "description": "从飞书消息中下载文件（视频、图片、文档等）到本地",
  "author": "勇哥的小飞侠 🧚🏻‍♀️🌸🧚🏻",
  "license": "MIT",
  "keywords": [
    "feishu",
    "lark",
    "download",
    "file",
    "message",
    "飞书",
    "下载",
    "文件"
  ],
  "main": "download.py",
  "scripts": {
    "test": "python3 download.py --help"
  },
  "engines": {
    "python": ">=3.8"
  },
  "dependencies": {
    "requests": "^2.28.0"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/Cindypapa/feishu-message-download"
  },
  "claw

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documentation declares capabilities that imply access to environment secrets, local files, and outbound network requests, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this weakens least-privilege enforcement and can let the skill access credentials and write downloaded content to disk without clear policy controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill automatically reads Feishu credentials from environment variables and local OpenClaw configuration files, expanding its credential-access scope beyond explicit user input. While this is likely intended for convenience, it increases the chance of using secrets the user did not expect this tool to access, especially in shared or multi-skill environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · download.py (reported line 133)May include surrounding context.

python
}
        
        try:
            response = requests.post(url, headers=headers, json=data)
            response.raise_for_status()
            result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code downloads remote content and writes it directly to a local path derived from user-controlled or server-supplied filename data without an explicit safety prompt. This can lead to unexpected file creation and, combined with unsafe filename handling, may overwrite or place files outside the intended directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description, CLI help text, errors, and status messages are all presented in Chinese, which imposes a specific language on all users. The file does not provide any option to select another language or indicate that the tool is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description is written only in Chinese, which can impose a language-specific experience on users without offering any alternative or opt-in. Under the policy, natural-language content that forces a specific language may be a locale/language policy violation unless choice or justification is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dependency on requests is version-ranged with a caret, which allows automatic adoption of newer releases within the allowed range. In supply-chain contexts, loose dependency pinning can introduce unexpected vulnerable or malicious package updates and reduces build reproducibility.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"python": ">=3.8"
  },
  "dependencies": {
    "requests": "^2.28.0"
  },
  "repository": {
    "type": "git",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows installation of any future version and does not guarantee a reproducible or reviewed package set. This increases supply-chain risk and can unexpectedly pull in vulnerable or breaking releases during deployment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version includes fixes for known advisories. In a skill that downloads files from Feishu messages, network-facing HTTP behavior is directly relevant, so ambiguity around the exact requests version meaningfully increases exposure to dependency-related security flaws.

Content

No source excerpt is available for this finding.