Security audit

Feishu Group Chat

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about its goal, but it sends Feishu group messages as the user and includes unsafe shell/script patterns that need review before installation.

Install only after reviewing and fixing the helper script. Do not source its output as shell code, restrict Feishu scopes and app credentials, require explicit confirmation before any message send or image upload, and treat all group messages and display-name prefixes as untrusted unless verified by authenticated sender IDs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send_group_message.sh:213
Finding: Arbitrary Shell Command Execution Through Source-Friendly Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send_group_message.sh:37
Finding: Arbitrary Python Execution Through Unsafe Identifier Interpolation
Content: View full analysis
/dev/null) || { echo "错误: 配置读取失败" >&2; exit 1; } ``` ### Technical Analysis `GROUP_KEY` and `CONTACT_KEY` are inserted directly into the source text passed to `python3 -c`. They are not passed as Python arguments, decoded as JSON, or restricted to a safe identifier syntax. A value containing a quote and valid Python syntax can escape the intended string literal and alter the Python program. The injected program runs locally under the same account as the shell script. The same pattern also interpolates `$CONFIG` into Python source. Although the script computes that path internally, using source-code interpolation for paths remains unsafe and unnecessarily fragile. ### Attack Path 1. An attacker influences the group key or contact key passed to the script. 2. The attacker supplies a value containing quote characters and Python syntax that terminates the intended string literal. 3. Shell expansion inserts that value directly into the `python3 -c` source. 4. Python parses the injected statements as part of the program. 5. The statements execute with the local privileges of the Skill process before normal message construction completes. This ...[truncated 728 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:198
Finding: Spoofable Contact Attribution Through Message Prefixes
Content: View full analysis
``` 3. The Agent follows the documented rule to evaluate the prefix before the authenticated `sender_id`. 4. The prefix matches the configured contact name. 5. The Agent treats the message as originating from the trusted contact and replies or acts through the Skill. 6. If downstream task execution is permitted, the attacker-controlled instruction can influence additional Agent tools or workflows under a false identity. ### Impact Assessment The immediate impact is contact impersonation and incorrect authorization decisions. Depending on the tools available to the Agent and how gr ...[truncated 554 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/send_group_message.sh:106
Finding: Direct Access to Long-Lived Feishu Application Credentials Exceeds Message-Construction Needs
Content: View full analysis
/dev/null) if [ -z "$CREDS" ]; then echo "错误: 无法读取飞书应用凭证" >&2; exit 1 fi APP_ID=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appId'])") APP_SECRET=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appSecret'])") TOKEN_RESP=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" 2>/dev/null) ``` ### Technical Analysis The script directly opens the global OpenClaw configuration and extracts the Feishu application ID and application secret. It then exchanges those long-lived credentials for a tenant access token. This behavior is used only for the optional image-upload path. It is broader than the script's primary message-construction function and differs from the user OAuth model described in `PERMISSIONS.md`. Giving the script direct access to a long-lived application secret increases the consequences of any local code-execution flaw, including the confirmed injection vulnerabilities in the same script. The reviewed code transmits these credentials only to the official `https://open.feishu.cn` token endpoint. No exfiltration to an untrusted host or remote-script retrieval was found. ### Attack Path 1. The image-upload mode is invoked. 2. The script reads `$HOME/.openclaw/openclaw.json`. 3. It extracts the Feishu `appId` and `appSecret`. 4. The credentials are held in process variables and exch ...[truncated 910 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 17)May include surrounding context.
md
## v2.0.0 (2026-05-20) ### 破坏性变更 - **敏感信息分离**：`config.json` 不再包含 open_id / chat_id，拆分到 `secrets.json`（不纳入版本控制） - **脚本输出格式**：从 JSON 输出改为 source-friendly 环境变量（`CHAT_ID`, `MSG_TYPE`, `MSG_CONTENT`, `HAS_IMAGE`, `IMAGE_KEY`） - **消息格式统一**：at=true 时固定为 3 元素结构 `text(prefix) → at(对方) → text(正文)`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 23)May include surrounding context.
md
## v2.0.0 (2026-05-20) ### 破坏性变更 - **敏感信息分离**：`config.json` 不再包含 open_id / chat_id，拆分到 `secrets.json`（不纳入版本控制） - **脚本输出格式**：从 JSON 输出改为 source-friendly 环境变量（`CHAT_ID`, `MSG_TYPE`, `MSG_CONTENT`, `HAS_IMAGE`, `IMAGE_KEY`） - **消息格式统一**：at=true 时固定为 3 元素结构 `text(prefix) → at(对方) → text(正文)`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
## v2.0.0 (2026-05-20) ### 破坏性变更 - **敏感信息分离**：`config.json` 不再包含 open_id / chat_id，拆分到 `secrets.json`（不纳入版本控制） - **脚本输出格式**：从 JSON 输出改为 source-friendly 环境变量（`CHAT_ID`, `MSG_TYPE`, `MSG_CONTENT`, `HAS_IMAGE`, `IMAGE_KEY`） - **消息格式统一**：at=true 时固定为 3 元素结构 `text(prefix) → at(对方) → text(正文)`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PERMISSIONS.md (reported line 3)May include surrounding context.
md
# 权限需求本技能核心依赖：**用户 OAuth 授权（User Access Token）** `feishu_im_user_message` 以用户身份发消息，必须用户先完成 OAuth 授权，否则所有发送操作都会失败。

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PERMISSIONS.md (reported line 12)May include surrounding context.
md
# 权限需求本技能核心依赖：**用户 OAuth 授权（User Access Token）** `feishu_im_user_message` 以用户身份发消息，必须用户先完成 OAuth 授权，否则所有发送操作都会失败。

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_group_message.sh (reported line 121)May include surrounding context.
sh
APP_ID=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appId'])") APP_SECRET=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appSecret'])") TOKEN_RESP=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" 2>/dev/null)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_group_message.sh (reported line 136)May include surrounding context.
sh
echo "错误: 获取 tenant_access_token 失败" >&2; exit 1 fi UPLOAD_RESP=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/im/v1/images' \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -F "image_type=message" \ -F "image=@$IMAGE_PATH" 2>/dev/null)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The permission guide instructs agents to verify authorization by sending a real test message as the user, but it does not require prior user notice, consent for that specific action, or guidance to make the side effect explicit. That creates a silent side-effect risk: a first-use check can post unintended content into a group, which may leak context, confuse participants, or trigger workflows under the user's identity.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs use of shell scripts (send_group_message.sh) and process substitution (source <(bash ...)) but does not declare any tool scope or allowed-tools boundary. That increases the chance an agent will invoke shell unexpectedly or without least-privilege review, which is risky because the script reads local config, may upload images, and emits variables later passed to messaging tools.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly describes bypassing Feishu's restriction on bot-to-bot interaction by making the bot speak through a user's identity and prepend a bot name to simulate bot messages. That is an impersonation workflow designed to evade platform controls, which can mislead recipients, defeat audit expectations, and enable unauthorized automated actions to appear user-originated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scope is extremely broad (发消息、回复消息、发自拍、闲聊) and overlaps with ordinary conversation, making accidental invocation more likely. In this skill, mis-triggering is more dangerous than usual because the workflow can send messages under a user's identity into group chats, potentially causing unintended impersonation or spam.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file first states as a hard rule that only feishu_im_user_message should be used for sending, and later says replies to ordinary user messages should use the message tool with Bot identity. It then further contradicts itself by banning use of message for group messages entirely. These instructions cannot all be true at once, creating intent ambiguity for agents following the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script reads local workspace identity files and automatically injects the discovered name into outgoing messages. In this skill, that behavior is used to impersonate or simulate a bot speaking through a user's identity in group chat, which increases the risk of misleading attribution and unintended disclosure of local workspace metadata beyond what is necessary to send a message.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script silently reads Feishu application credentials from the user's local OpenClaw config and uploads a caller-supplied local file to Feishu. Because the skill is explicitly designed to act in group chats and can send images under a user's identity, this creates a meaningful risk of unauthorized external transmission of sensitive local content if invoked with an unsafe path or by a higher-level agent without clear disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send_group_message.sh (reported line 121)May include surrounding context.
sh
APP_ID=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appId'])") APP_SECRET=$(echo "$CREDS" | python3 -c "import json,sys; print(json.load(sys.stdin)['appSecret'])") TOKEN_RESP=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" 2>/dev/null)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, with no statement that the skill is China-specific or that users can choose another language. That can conflict with a language/locale policy requiring user opt-in or documented locale justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file’s natural-language instructions and warnings are entirely in Chinese, which can effectively force a specific language on users or downstream agents consuming the skill documentation. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Most of the document consistently describes contact/group data as stored in config.json, but the adaptive reply logic says sender matching uses secrets.json. That is an active contradiction about where identity mapping comes from, which could cause an agent to read or modify the wrong file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language documentation strings in this manifest/config template are exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and this file does not offer any alternative language or indicate that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script's natural-language interface elements, including description and usage comments, are entirely in Chinese and do not indicate that language selection is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a locale-policy concern.
Content: No source excerpt is available for this finding.