ClawHub
Back to skill

Security audit

Feishu Relay

Security checks for vulnerabilities and agentic risk

Overview

The core Feishu notification function is coherent, but an opt-in discovery script can scan other OpenClaw workspaces and skills and link untrusted executable scripts without enough validation.

Install only if you need a Feishu/Lark notification bridge and are comfortable sending message content to Feishu. Keep FEISHU_APP_SECRET and config.json private. Avoid running scripts/install-discovery.sh unless you have reviewed every OpenClaw workspace/skill it can scan, because it may link executable notify scripts from other packages into this skill.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/install-discovery.sh:45
Finding

Untrusted Executable Discovery Enables Tool Hijacking

Content
View full analysis
$link" else if [ ! -L "$link" ]; then ln -sf "$script" "$link" echo "Linked: $basename" found=1 fi fi ``` ### Technical Analysis The opt-in discovery installer scans scripts belonging to other workspaces and installed skills. Any executable whose filename matches `*notify*.sh` or `*Notifier*.sh` is linked into the local `.discovered` directory. Trust is established solely from the filename, executable bit, and location under a broad wildcard path. The installer does not validate: - The source file's owner or permissions. - Whether the source is itself a symbolic link. - The canonical source path after resolving symbolic links. - The originating skill's identity or trust status. - An approved filename, path, signature, or cryptographic hash. ...[truncated 2113 chars]
Remediation
View remediation
&2 continue fi ``` 8. Prefer copying a reviewed script with a recorded cryptographic hash over linking to mutable external content. 9. Ensure downstream consumers never automatically execute discovered files. They should independently validate an allowlist, ownership, permissions, and integrity. 10. Update `skill.json` to accurately disclose the external filesystem read scope required by auto-discovery. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
## What This Does

✅ **Core (always available)**:
- Send messages to Feishu via Open API
- JSON structured output
- Config via environment or skill config
- Retry on network failure

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/send.py (reported line 92)May include surrounding context.

python
"/etc/openclaw/skills/feishu-relay/config.json",
            # Fallback: relative to current working directory
            "./config.json",
            # Legacy: .env file in skill directory
            os.path.join(skill_dir, ".env") if skill_dir else None,
        ]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/send.py (reported line 93)May include surrounding context.

python
# Fallback: relative to current working directory
            "./config.json",
            # Legacy: .env file in skill directory
            os.path.join(skill_dir, ".env") if skill_dir else None,
        ]
        
        # Filter out None values

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/send.py (reported line 214)May include surrounding context.

python
raise APIError(f"Request failed after {self.config.max_retries} retries: {e}")
    
    def get_access_token(self) -> str:
        """Get tenant access token with caching"""
        # Return cached token if still valid (with 60s buffer)
        if self._token and time.time() < self._token_expires - 60:
            return self._token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/send.py (reported line 236)May include surrounding context.

python
raise APIError(f"Request failed after {self.config.max_retries} retries: {e}")
    
    def get_access_token(self) -> str:
        """Get tenant access token with caching"""
        # Return cached token if still valid (with 60s buffer)
        if self._token and time.time() < self._token_expires - 60:
            return self._token

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

After base install, enable production capabilities:

./scripts/install-systemd.sh --install --user # 24/7 daemon ./scripts/install-watchdog.sh --install # Health monitoring sudo ./scripts/install-global-notify.sh --install # /usr/local/bin/notify

text

**What you get (in addition to defaults):**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly sends user-provided message content to Feishu via the Open API, but the description does not clearly warn users that their data will leave the local environment and be transmitted to a third-party service. This is primarily a transparency and consent issue: users may disclose sensitive content without realizing it is being exfiltrated over the network to an external platform.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
- No secrets in logs
- No system modifications
- No root required for basic use
- Config file: `chmod 600 config.json`

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code includes natural-language strings in Chinese, including the module description and later default message titles/content, without offering a language or locale choice. That creates a locale-policy issue because the skill imposes a specific language on users rather than letting them opt in or configure it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The default title "系统通知" is automatically sent in outgoing messages when no title is provided, which forces Chinese output regardless of user preference. The file does not provide an explicit language selection or opt-in mechanism for this behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command-line interface defaults the --title argument to the Chinese phrase "系统通知", causing user-facing output in a fixed language unless the caller overrides it. This is a natural-language locale constraint that is not presented as optional or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file instructs users to set an app secret and optionally place it in config.json, and the skill’s purpose is to send messages to Feishu. While the README explains usage, it does not clearly disclose the privacy/security implications that message content is transmitted to an external service and that credentials must be handled carefully.

Content

No source excerpt is available for this finding.