T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:19
- Finding
- Hard-Coded Feishu Application Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 19–21 **Vulnerability Type**: Hard-coded application secret in configuration documentation **Risk Level**: High ```json "mcpUrl": "https://feishu-openai-mcp-proxy.bytedance.net/mcp", "appID": "cli_a926728f3e38dcba", "appSecret": "BiL8CymBwxiA998MXxvUKbN23RhPsxAg" ``` ### Technical Analysis The skill embeds a Feishu application ID and application secret directly in a configuration example. The documentation instructs users to copy these credentials into the persistent `~/.openclaw/openclaw.json` configuration file and states that authentication is automatically performed with the supplied `appID` and `appSecret`. An application secret is an authentication credential and must not be distributed in source-controlled skill content. Anyone able to obtain this package can extract the credential without authorization. If the credential is genuine, active, and accepted by the relevant Feishu authentication service or MCP proxy, an attacker could attempt to authenticate as the associated application. The supported integration operations include reading documents and tables, creating documents, replacing or appending document content, and writing table values. Consequently, successful credential reuse could expose both read and modification capabilities, subject to the application's configured scopes, tenant installation state, resource accessibility, and any additional authorization controls. ### Attack Path 1. An attacker downloads or otherwise obtains access to the skill package. 2. The attacker reads `SKILL.md` and extracts the plaintext `appID` and `appSecret`. 3. The attacker submits the exposed credentials to the relevant Feishu authentication flow or configures a compatible client to use the documented MCP endpoint. 4. If the credentials remain active and all required tenant or application authorization conditions are satisfied, the attacker obtains an application access token or invokes the M ...[truncated 1252 chars]
- Remediation
- ## Remediation Suggestions 1. **Immediately revoke and rotate the exposed secret.** Treat it as compromised because it has been distributed in plaintext. 2. **Remove the application ID and secret from `SKILL.md` and repository history.** Purging only the current file is insufficient if prior versions remain accessible. 3. **Replace real credentials with unmistakable placeholders**, for example: ```json { "appID": "<YOUR_FEISHU_APP_ID>", "appSecret": "<YOUR_FEISHU_APP_SECRET>" } ``` 4. **Obtain secrets from protected runtime configuration.** Use environment variables, an operating-system credential store, or an approved secret-management service rather than embedding secrets in skill files. 5. **Avoid shared credentials.** Require each deployment or organization to create and manage its own Feishu application credentials. 6. **Apply least privilege.** Grant only the Feishu scopes required for the intended document operations and avoid tenant-wide permissions where resource-specific access is sufficient. 7. **Restrict access server-side.** Where supported, apply tenant restrictions, application allowlists, proxy authorization, rate limits, and credential-use monitoring. 8. **Audit historical use.** Review Feishu and MCP proxy logs for unexpected authentication, document reads, writes, table modifications, or unusual quota consumption involving the exposed application. 9. **Add automated secret scanning** to repository and package publication workflows to prevent future inclusion of application secrets, tokens, or private keys.