T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:86- Finding
Unnecessary Access to Privileged Feishu Application Credentials
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 86–96
Vulnerability Type: Violation of least privilege through local credential access
Risk Level: MediumVulnerable Code
python with open('/root/.openclaw/openclaw.json') as f: cfg = json.load(f) app_id = cfg['channels']['feishu']['appId'] app_secret = cfg['channels']['feishu']['appSecret'] req = urllib.request.Request( 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(), headers={"Content-Type": "application/json"} ) token = json.loads(urllib.request.urlopen(req).read())['tenant_access_token']Technical Analysis
The Skill is declared as a tool for looking up publicly available Feishu API documentation through web search and page retrieval. That task does not require tenant authentication or access to local application credentials.
However, the authentication section instructs the Agent to open the root-owned OpenClaw configuration file, extract the Feishu application ID and secret, and transmit those credentials to Feishu's tenant-token endpoint. This gives the executing process access to sensitive credentials and creates a tenant bearer token that can be used with the configured application's authorized API scopes.
The network destination shown is the official
open.feishu.cnservice, and the exchange is part of Feishu's normal authentication flow. Therefore, the reviewed content does not establish malicious exfiltration to an attacker-controlled destination. The security issue is that this sensitive operation exceeds the minimum privileges required for the Skill's declared documentation-lookup functionality.The generic authenticated-request example later in the file allows the resulting token to be supplied to arbitrary Feishu API paths. Depending on the application's assigned scopes, this may permit both data retrie ...[truncated 1762 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the credential-reading and tenant-token acquisition example from this documentation-lookup Skill.
- Keep the Skill limited to public documentation operations such as
web_searchandweb_fetch. - Move authenticated API execution into a separate Skill whose declared purpose explicitly includes acting on Feishu resources.
- If authentication must be documented, use nonfunctional placeholders such as
FEISHU_APP_IDandFEISHU_APP_SECRET; do not direct the Agent to a root-owned configuration file. - Retrieve secrets through an approved secret-management interface rather than reading the complete OpenClaw configuration.
- Require explicit user confirmation before accessing credentials, obtaining a tenant token, or making an authenticated API request.
- Restrict the Feishu application to the narrowest API scopes needed for the requested operation.
- Prefer read-only scopes and endpoints unless the user explicitly requests a mutation.
- Avoid displaying, logging, or persisting application secrets and bearer tokens.
- Validate requested API paths against an allowlist if authenticated execution is supported.
- Rotate the application secret if there is evidence that it has been exposed outside the intended runtime.