T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:288
- Finding
- Direct Access to Privileged Feishu Application Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 288–291 and 317 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Relevant Code**: ```bash TOKEN=$(curl -s https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{"app_id":"'$APP_ID'","app_secret":"'$APP_SECRET'"}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") ``` ```markdown **Credentials:** Read from `/root/.openclaw/openclaw.json` → `channels.feishu.appId` / `channels.feishu.appSecret`. ``` ### Technical Analysis The Skill instructs the Agent to read an application ID and application secret directly from a root-owned OpenClaw configuration file. It then uses those credentials outside the declared `feishu_doc` tool abstraction to obtain a tenant access token. This behavior expands the Agent's access from document operations to direct possession of an application-level secret and bearer token. It therefore exceeds the minimum privilege required for normal use of the documented tool. The shell command also interpolates credential variables into a command without using a JSON serializer or otherwise robustly separating data from shell syntax. Unexpected shell metacharacters in configuration values could affect argument construction, while command tracing, debugging output, or logs could expose sensitive values. The request shown is sent to the official `open.feishu.cn` authentication endpoint, and the reviewed file contains no evidence that credentials are transmitted to an attacker-controlled service. The static pre-scan allegation of `curl | bash` is not present: the response is piped to a Python JSON parser rather than executed as shell code. ### Attack Path 1. The Skill is activated for a document operation requiring a table with `header_row`. 2. Following the documented instructions, the Agent accesses `/root ...[truncated 1223 chars]
- Remediation
- ## Remediation Suggestions 1. Add creation-time `header_row` support to the trusted `feishu_doc` tool so the Skill never needs direct access to application credentials. 2. Prohibit Skill instructions from reading `/root/.openclaw/openclaw.json` or exposing `appSecret` to the Agent's general-purpose execution context. 3. If direct API access remains necessary, provide a narrowly scoped credential broker that performs the specific approved Feishu operation without returning the secret or tenant token. 4. Enforce least-privilege Feishu application scopes and, where supported, restrict operations to explicitly authorized documents or folders. 5. Build request bodies with a safe JSON serializer rather than shell string interpolation. 6. Disable shell tracing and redact secrets and bearer tokens from command output, telemetry, error messages, and logs. 7. Require explicit user authorization before bypassing the normal `feishu_doc` abstraction. 8. Rotate the application secret if there is evidence that it has appeared in logs or other untrusted output.