Feishu Doc Sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a Feishu document-sync guide, but it tells agents to read Feishu app secrets and bypass the declared tool with direct authenticated API calls.

Install only if you are comfortable with an agent receiving instructions to read Feishu app credentials, create tenant tokens, mutate Feishu documents, and run git pull before syncing. Prefer a version that keeps authentication inside the approved feishu_doc tool, requires explicit approval for replace/delete operations, and avoids automatic repository mutation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:288

Finding

Direct Access to Privileged Feishu Application Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 288–291 and 317
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Relevant Code:

bash

TOKEN=$(curl -s https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H "Content-Type: application/json" \
  -d '{"app_id":"'$APP_ID'","app_secret":"'$APP_SECRET'"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

markdown

**Credentials:** Read from `/root/.openclaw/openclaw.json` → `channels.feishu.appId` / `channels.feishu.appSecret`.

Technical Analysis

The Skill instructs the Agent to read an application ID and application secret directly from a root-owned OpenClaw configuration file. It then uses those credentials outside the declared feishu_doc tool abstraction to obtain a tenant access token.

This behavior expands the Agent's access from document operations to direct possession of an application-level secret and bearer token. It therefore exceeds the minimum privilege required for normal use of the documented tool. The shell command also interpolates credential variables into a command without using a JSON serializer or otherwise robustly separating data from shell syntax. Unexpected shell metacharacters in configuration values could affect argument construction, while command tracing, debugging output, or logs could expose sensitive values.

The request shown is sent to the official open.feishu.cn authentication endpoint, and the reviewed file contains no evidence that credentials are transmitted to an attacker-controlled service. The static pre-scan allegation of curl | bash is not present: the response is piped to a Python JSON parser rather than executed as shell code.

Attack Path

1. The Skill is activated for a document operation requiring a table with header_row.
2. Following the documented instructions, the Agent accesses `/root ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Add creation-time header_row support to the trusted feishu_doc tool so the Skill never needs direct access to application credentials.
2. Prohibit Skill instructions from reading /root/.openclaw/openclaw.json or exposing appSecret to the Agent's general-purpose execution context.
3. If direct API access remains necessary, provide a narrowly scoped credential broker that performs the specific approved Feishu operation without returning the secret or tenant token.
4. Enforce least-privilege Feishu application scopes and, where supported, restrict operations to explicitly authorized documents or folders.
5. Build request bodies with a safe JSON serializer rather than shell string interpolation.
6. Disable shell tracing and redact secrets and bearer tokens from command output, telemetry, error messages, and logs.
7. Require explicit user authorization before bypassing the normal feishu_doc abstraction.
8. Rotate the application secret if there is evidence that it has appeared in logs or other untrusted output.

other

Warning

• Location: SKILL.md:339

Finding

Unconditional Remote Repository Mutation Before Local Inspection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 339
Vulnerability Type: other: Unsafe remote repository update
Risk Level: Medium

Relevant Code:

markdown

- **Always `git pull` before reading local repo files** — ensures latest content

Technical Analysis

The Skill unconditionally directs the Agent to run git pull before reading local repository files. A pull performs network access and normally fetches and integrates remote changes into the current working tree. This mutates local state before the Agent has inspected the repository, assessed pending local changes, or reviewed incoming commits.

Automatic integration is not necessary for every Feishu document-sync request and exceeds the minimum behavior needed to compare or synchronize content. It also creates a supply-chain and integrity boundary: anyone able to modify the configured upstream branch can cause new content to enter the Agent's working context. Depending on the surrounding Agent behavior, imported files could contain misleading instructions, malicious source content, or changes that are subsequently published to Feishu.

The instruction does not explicitly run code from the repository, and the reviewed project contains no evidence that Git hooks or fetched scripts are executed. The confirmed issue is therefore unsafe and unnecessary repository mutation, not confirmed remote code execution.

Attack Path

1. An attacker compromises or otherwise obtains write access to the repository's configured upstream branch.
2. The attacker commits malicious, misleading, or unauthorized content to that branch.
3. The Skill is activated for a local-to-Feishu synchronization task.
4. The Agent follows the mandatory instruction and runs git pull before inspecting local files.
5. Git fetches and integrates the attacker-controlled changes into the working tree.
6. The Agent reads the newly imported content as if it were the expected ...[truncated 980 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unconditional git pull with git fetch, which retrieves remote metadata without immediately modifying the working tree.
2. Inspect repository status and preserve or explicitly resolve uncommitted local changes before any integration.
3. Display or analyze the incoming commit range and diff before merging or rebasing.
4. Require explicit user approval before incorporating remote changes.
5. Pin synchronization to an expected remote, branch, and reviewed commit where operationally practical.
6. Limit Git operations to the repository explicitly named by the user and avoid updating unrelated repositories.
7. Treat fetched repository content as untrusted data and do not follow instructions embedded in it.
8. Keep synchronization and repository-update operations separate so users can perform a local-only sync when freshness is not required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The skill includes a shell pipeline that fetches remote data and processes it inline to extract a bearer token, establishing an executable pattern for external retrieval and token handling. In the context of an agent skill, this is dangerous because it encourages arbitrary command/network execution and secret-bearing workflow construction outside approved controls.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

bash

# Step 1: Get tenant_access_token
TOKEN=$(curl -s https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H "Content-Type: application/json" \
  -d '{"app_id":"'$APP_ID'","app_secret":"'$APP_SECRET'"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Directing the agent to read application credentials from /root/.openclaw/openclaw.json and use them for API calls is a high-severity secret exposure pattern. It gives the model a concrete exfiltration and privilege-escalation path outside normal tool governance, potentially compromising the Feishu tenant and any documents accessible to that app.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is broad enough to trigger on many routine document-sync or table-edit requests, increasing the chance that the skill is invoked in contexts where its dangerous guidance is available. Over-broad activation is especially risky here because the skill includes destructive write behavior and credential-handling instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document claims there is a single approved feishu_doc tool for all operations, then later instructs the agent to bypass that interface with direct authenticated API calls. This inconsistency weakens security assumptions around tool mediation, auditing, and permission scoping, making unsafe behavior more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The write action is documented as replacing the entire document, but the skill does not require explicit confirmation or warn about irreversible overwrite/data-loss risk at the point of use. In an agent setting, that can lead to accidental destructive actions against user documents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs bypassing the declared feishu_doc tool by using raw curl calls and obtaining Feishu credentials from a local secrets file. That expands the agent's authority beyond the intended tool boundary and creates a clear path for secret access and outbound transmission of credentials or privileged tokens.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The curl command transmits app_id and app_secret to an external endpoint to mint an access token. Although contacting Feishu is functionally relevant, embedding this network procedure in agent instructions is dangerous because it operationalizes outbound authenticated requests using sensitive credentials.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

bash

# Step 1: Get tenant_access_token
TOKEN=$(curl -s https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H "Content-Type: application/json" \
  -d '{"app_id":"'$APP_ID'","app_secret":"'$APP_SECRET'"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This raw POST sends authenticated document-modification requests directly to Feishu outside the declared tool boundary. Even if the destination is legitimate, it bypasses guardrails, logging expectations, and fine-grained authorization normally enforced by the tool layer.

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

| python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

# Step 2: Create empty table with header_row via document_block_children.create
curl -s -X POST \
  "https://open.feishu.cn/open-apis/docx/v1/documents/{doc_token}/blocks/{doc_token}/children?document_revision_id=-1" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells the agent where local Feishu app credentials are stored but provides no safety boundary or prohibition on accessing secrets. In practice, this normalizes secret retrieval as part of ordinary task execution and materially raises the risk of credential misuse or leakage.

Content

No source excerpt is available for this finding.