ClawHub
Back to skill

Security audit

Feishu Card

Security checks for vulnerabilities and agentic risk

Overview

This Feishu card skill is purpose-aligned and disclosed, but it should only be installed by users who expect it to read a local Feishu app secret and send messages through that Feishu app.

Install only if you intend this skill to send Feishu messages using the configured OpenClaw Feishu app. Verify the hard-coded app_id and any recipient open_id values match your tenant, and prefer a managed message tool or secret manager so the app secret is not exposed in shell commands or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

External Script Fetching

High
Category
Supply Chain
Content
```bash
APP_SECRET=$(cat /root/.openclaw/openclaw.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['channels']['feishu']['appSecret'])")
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"cli_a9f5877b3378dbd8\",\"app_secret\":\"$APP_SECRET\"}" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Chaining Abuse

High
Category
Tool Misuse
Content
'body': {'elements': [{'tag': 'markdown', 'content': '内容'}]}
}
print(json.dumps(json.dumps(card)))
" | xargs -I{} curl -s -X POST \
  "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documents direct network usage via Python scripts and curl calls but does not declare any tool scope or allowed-tools metadata. In an agent environment, undeclared network capability reduces transparency and weakens policy enforcement, making it easier for the skill to perform outbound actions users or reviewers did not explicitly approve.

Natural-Language Policy Violations

Medium
Confidence
84% confidence
Finding
The skill content is entirely written as Chinese-only operational guidance, and the title/description do not indicate that language choice is optional or that the skill is intentionally limited to Chinese-speaking users. The policy specifically calls out forced language or locale behavior without user opt-in as a violation.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The documentation instructs readers to extract an app secret from a local credential file and use it in API authentication flows. That goes beyond formatting card payloads and encourages direct handling of sensitive credentials, increasing the risk of credential exposure, misuse, or repurposing by an agent following the instructions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill normalizes pulling a secret from a local credential file and transmitting it in an authentication request without any warning, boundary, or secure handling guidance. In an agentic context, this can cause automated secret access and outbound use of credentials, which is especially dangerous because the skill's stated purpose is message formatting, not secret management.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
APP_SECRET=$(cat /root/.openclaw/openclaw.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['channels']['feishu']['appSecret'])")
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"cli_a9f5877b3378dbd8\",\"app_secret\":\"$APP_SECRET\"}" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")
Confidence
94% confidence
Finding
This finding reflects outbound transmission to Feishu's token endpoint using a locally sourced secret. External transmission is expected for a messaging skill, but here it is security-relevant because the transmitted data includes authentication material derived from local credentials, creating a path from local secret access to external use.

External Transmission

Medium
Category
Data Exfiltration
Content
'body': {'elements': [{'tag': 'markdown', 'content': '内容'}]}
}
print(json.dumps(json.dumps(card)))
" | xargs -I{} curl -s -X POST \
  "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The manifest description is written entirely in Chinese and presents the skill behavior in that language without any indication of language choice or opt-in. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
Publishing a specific open_id and app_id embeds environment-specific operational identifiers unrelated to a reusable card-formatting skill. This creates unnecessary exposure of internal account details and can facilitate unintended targeting, misuse, or social engineering around the referenced Feishu tenant.

Static analysis

No suspicious patterns detected.