Security audit

Feishu Docx

Security checks for vulnerabilities and agentic risk

Overview

This skill can operate on Feishu documents, but it ships live-looking credentials and tenant-specific scripts that upload local content to a fixed Feishu destination without clear user control.

Review carefully before installing. Do not use the bundled credentials; they should be revoked and replaced with your own securely stored Feishu credentials. Remove or ignore the tenant-specific scripts unless you explicitly intend to upload that exact local file to that exact Feishu folder, and verify any remote create, upload, import, or delete operation before running it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:12
Finding: Hardcoded Feishu Application Credentials Exposed in Documentation and Executable Scripts
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/perfect_import_egg_cake.py:8
Finding: Private Workspace File Is Uploaded to a Hardcoded Tenant Destination
Content: View full analysis
Docx) print("Starting import task...") doc_token = client.import_markdown(file_token, file_name, folder_token) print(f"Import successful! New Doc Token: {doc_token}") print(f"URL: https://txx-claw.feishu.cn/docx/{doc_token}") # 3. 清理暂存的源文件 print(f"Deleting temporary source file: {file_token}") client.delete_file(file_token) ``` `scripts/import_egg_cake_report.py:6-24`: ```python app_id = "cli_a92c5076b7789cd2" app_secret = "9jPdCn49G54RFoEoDPUCVcptnWZnTZqp" folder_token = "CicIfQH2VlKqV0dBK4mceVMRnqf" file_path = "/Users/cpjhy0535/.openclaw/workspace-master/cases/空气炸锅鸡蛋饼 - 爆款拆解报告.md" title = "空气炸锅鸡蛋饼 - 爆款拆解报告" if not os.path.exists(file_path): print(f"Error: File not found at {file_path}") sys.exit(1) with open(file_path, 'r', encoding='utf-8') as f: content = f.read() client = FeishuDocx(app_id, ap ...[truncated 3271 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/feishu_docx_client.py:45
Finding: Feishu Resource Identifiers and API Error Bodies Are Written to Logs
Content: View full analysis
Docx) print("Starting import task...") doc_token = client.import_markdown(file_token, file_name, folder_token) print(f"Import successful! New Doc Token: {doc_token}") print(f"URL: https://txx-claw.feishu.cn/docx/{doc_token}") # 3. 清理暂存的源文件 print(f"Deleting temporary source file: {file_token}") ``` ### Technical Analysis The code prints file tokens, document tokens, destination metadata, complete API payloads, tenant-specific URLs, and unfiltered response bodies to standard output. Feishu file and document tokens are resource identifiers and are not equivalent to the App Secret or bearer access token. They may not independently bypass Feishu access control. However, exposing them in terminal histories, CI log ...[truncated 1650 chars]
Remediation: View remediation
str: if not value: return "" return f"{value[:4]}...{value[-4:]}" ``` 4. Replace complete response-body logging with a sanitized status code, request correlation ID, and approved non-sensitive error fields. 5. Do not include raw response bodies in raised exceptions. 6. Use a structured logging framework with secure defaults and explicit log levels. 7. Disable debug logging by default and require an intentional opt-in. 8. Configure retention and access controls for CI, agent, and application logs. 9. Add tests confirming that credentials, bearer tokens, file tokens, document tokens, and folder tokens never appear in logs. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description promises broad creation/editing capabilities but the implementation appears to perform only a narrow preset workflow against a fixed folder/resource using embedded credentials. This discrepancy is security-relevant because it conceals the true operational scope and destination of writes, making unauthorized or unintended modification of a specific Feishu resource more likely.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description promises broad creation/editing capabilities but the implementation appears to perform only a narrow preset workflow against a fixed folder/resource using embedded credentials. This discrepancy is security-relevant because it conceals the true operational scope and destination of writes, making unauthorized or unintended modification of a specific Feishu resource more likely.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description promises broad creation/editing capabilities but the implementation appears to perform only a narrow preset workflow against a fixed folder/resource using embedded credentials. This discrepancy is security-relevant because it conceals the true operational scope and destination of writes, making unauthorized or unintended modification of a specific Feishu resource more likely.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description promises broad creation/editing capabilities but the implementation appears to perform only a narrow preset workflow against a fixed folder/resource using embedded credentials. This discrepancy is security-relevant because it conceals the true operational scope and destination of writes, making unauthorized or unintended modification of a specific Feishu resource more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation contains concrete App ID and App Secret values directly in setup instructions and code examples. Embedded live-looking credentials are highly dangerous because they can be harvested for unauthorized API access, token generation, remote document manipulation, and potential abuse of the associated Feishu tenant.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill not only exposes credentials but also normalizes hardcoded secret usage without any warning about secure handling. This encourages insecure operator behavior, increases the chance of credential reuse and leakage, and makes accidental compromise more likely in downstream copies of the example.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares no explicit tool scope or permissions despite clearly describing network-based API access and implying file access via the referenced client script. Missing scope declarations reduce transparency and can cause an agent or user to underestimate the skill’s effective capabilities, especially when combined with other undocumented behaviors flagged here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is described as creating and editing Feishu cloud documents, which can alter user data in an external service. However, the markdown does not include any explicit warning or confirmation note that using the skill will write to remote documents and may modify existing content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/feishu_docx_client.py (reported line 19)May include surrounding context.
python
"app_id": self.app_id, "app_secret": self.app_secret } res = requests.post(url, json=payload) res.raise_for_status() return res.json().get("tenant_access_token")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description says it creates and edits Feishu docx documents, but the implementation also uploads arbitrary local files and deletes remote cloud files. This capability mismatch is dangerous because users or upstream agents may grant trust based on the narrower description, leading to unintended exfiltration of local data or destructive actions in Feishu Drive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The upload_file method sends arbitrary local file contents to Feishu over the network without any built-in disclosure, confirmation, or restriction on what may be uploaded. In an agent skill context, this increases the risk of silent exfiltration of sensitive local files if the caller passes an unexpected path.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/feishu_docx_client.py (reported line 69)May include surrounding context.
python
} } print(f"DEBUG Payload: {json.dumps(payload)}") res = requests.post(url, headers=headers, json=payload) if res.status_code != 200: print(f"DEBUG Response: {res.text}") res.raise_for_status()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/feishu_docx_client.py (reported line 110)May include surrounding context.
python
} } print(f"DEBUG Payload: {json.dumps(payload)}") res = requests.post(url, headers=headers, json=payload) if res.status_code != 200: print(f"DEBUG Response: {res.text}") res.raise_for_status()

Tainted flow: 'check_url' from requests.post (line 75, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/feishu_docx_client.py (reported line 78)May include surrounding context.
python
check_url = f"https://open.feishu.cn/open-apis/drive/v1/import_tasks/{ticket}" while True: time.sleep(1) check_res = requests.get(check_url, headers={"Authorization": f"Bearer {self.tenant_access_token}"}) check_res.raise_for_status() result_data = check_res.json()["data"]["result"] if result_data["job_status"] == 0: # 成功

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The delete_file method performs a remote deletion action with no confirmation, safety interlock, or user-facing warning. In an automation or agent setting, this can cause unintended destructive changes to cloud data if a wrong token is supplied or the action is triggered unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script contains a hard-coded absolute local file path and reads that file's full contents, then later uploads the content to Feishu. In the context of a reusable skill, this creates a real data exposure risk because it normalizes accessing a user's local filesystem and transferring content off-host without validation, minimization, or clear consent controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script reads a local Markdown file and sends its contents to a third-party service using API credentials, but provides no user-facing disclosure or consent step before transmission. This is dangerous because sensitive local data could be exfiltrated to an external platform unintentionally, especially in an agent/skill setting where users may not realize local files are being uploaded.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file embeds application credentials directly in source code and uses them without any disclosure or secure handling. Hard-coded secrets are highly dangerous because anyone with access to the code can reuse them to access the associated Feishu application, potentially leading to unauthorized document operations and broader data exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script uses a hard-coded absolute local path pointing to a user workspace file, which can cause unintended access to local data and makes the behavior non-transparent. In an agent skill context, hard-coded filesystem access is risky because it may exfiltrate sensitive user content without prompting and is not limited by runtime user choice.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The upload_file call sends a local file to cloud storage, which is a direct exfiltration path for potentially sensitive local data. In this skill context, that is more dangerous because the code targets a specific local file and performs the transfer automatically using embedded credentials, without any runtime consent or data classification checks.
Content: Scanner excerpt · scripts/perfect_import_egg_cake.py (reported line 23)May include surrounding context.
python
try: # 1. 上传文件到云端 print(f"Uploading file: {file_path}") file_token = client.upload_file(file_path, folder_token) print(f"File uploaded, token: {file_token}") # 2. 发起导入任务 (Markdown -> Docx)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script performs file upload, remote import, and remote deletion operations even though the skill description emphasizes creating and editing Feishu docx documents. That expanded behavior increases the attack surface because local content is transmitted to the cloud and then a cleanup action deletes the uploaded source object without any explicit user approval or visibility into what data is being handled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script automatically uploads a local file to Feishu and deletes the temporary remote source file with no user warning, consent, or confirmation step. Silent cloud operations are dangerous because users may not realize local content is being transmitted off-device or that cleanup actions are modifying remote state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file hardcodes a Feishu App ID and App Secret directly in source code, exposing reusable credentials to anyone who can read the repository, logs, or packaged skill. Embedded secrets are easily leaked, difficult to rotate safely, and may allow unauthorized use of the Feishu API, document creation, or access within the associated tenant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends document content to Feishu using an external API but provides no user-facing notice or consent flow, so users may unknowingly transmit data off-host. In this specific file the content is not especially sensitive, but the skill is a generic document creation/editing capability and could be reused with sensitive content, making silent exfiltration to a third-party service a real privacy and security concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The line states the skill allows 老大 to operate on documents, implying a fixed form of address in Chinese rather than a user-selectable language or locale-neutral phrasing. This is a natural-language policy concern because it imposes a specific linguistic convention without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.