ClawHub
Back to skill

Security audit

Feishu Message Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Feishu message reader, but thread mode can pull nearby unrelated chat messages and the documented token option can expose credentials locally.

Review this before installing in privacy-sensitive Feishu workspaces. Use a least-privileged Feishu app, prefer configured app credentials over passing --token on the command line, and be aware that --thread may transiently retrieve unrelated messages from the same chat even though it only prints filtered thread results.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_message.py:148
Finding

Tenant Access Token Exposure Through Command-Line Arguments

Content
View full analysis
`. ``` ### Technical Analysis The Skill permits a Feishu tenant access token to be supplied directly as a command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell history files. - Process inspection utilities or operating-system process interfaces. - Command auditing, terminal recording, and job execution logs. - Wrapper scripts, orchestration systems, or diagnostic reports that record complete command lines. The script does not intentionally transmit the token to an unrelated service. It uses the token as a bearer credential only for the fixed official Feishu API origin. The vulnerability is instead the local exposure created before the network request occurs. ### Attack Path 1. A user obtains a valid Feishu tenant access token. 2. The user runs the documented command with `--token `. 3. The complete invocation ...[truncated 1068 chars]
Remediation
View remediation

other

Warning
Location
scripts/fetch_message.py:128
Finding

Thread Retrieval Downloads Unrelated Chat Messages Before Local Filtering

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill explicitly instructs running a Python script that uses network access to the Feishu API and reads secrets from local config files or environment variables, but the manifest declares no permissions or allowed tool scope. That mismatch weakens security boundaries and can lead to unexpected credential use or outbound data access without clear policy enforcement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/fetch_message.py (reported line 123)May include surrounding context.

python
# Fetch root message
    root_resp = fetch_message(token, root_id)
    root_items = root_resp.get("data", {}).get("items", [])
    root_create = None
    if root_items:
        root_create = root_items[0].get("create_time")

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a skill for fetching Feishu message content by message_id, with optional thread context. While obtaining authentication is necessary, this implementation also scans a specific local config file and environment variables for reusable credentials, which is a broader capability than the manifest states and exposes local secret-reading behavior not mentioned in the skill purpose.

Content

No source excerpt is available for this finding.