ClawHub
Back to skill

Security audit

feishu-emoji

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for sending Feishu emoji images, but it needs review because it downloads unvalidated third-party media into OpenClaw storage and can send it to chats.

Install only if you are comfortable with the agent contacting fabiaoqing.com and related image CDNs, saving downloaded files into OpenClaw's media directory, and sending those files in Feishu chats. Prefer explicit user requests, restrict allowed image hosts, add media size/type validation, sanitize filenames, and avoid automatically executing tool-call text printed by the helper script.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
emoji_sender.py:47
Finding

Unvalidated Remote Image URL Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
emoji_sender.py:69
Finding

Unbounded Remote Download Can Exhaust Memory and Persistent Storage

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
emoji_sender.py:89
Finding

User-Controlled Text Is Embedded in an Executable-Looking Agent Tool Call

Content
View full analysis
2 else f"{keyword} emoji is here!" ``` ### Technical Analysis The script interpolates the command-line message directly inside a quoted, executable-looking `message(...)` invocation. Quotes, line breaks, backslashes, and instruction-like content are not escaped or structurally serialized. The output explicitly tells the OpenClaw agent to execute the generated invocation. A crafted message can consequently break the apparent argument boundary, alter the displayed call, or append additional instructions. The Python process does not execute the generated text itself; exploitation depends on an agent or operator interpreting or copying the output as a trusted tool call. This is an instruction-channel injection issue rather than direct local command execution. ### Attack Path 1. An attacker supplies a crafted second command-line argument containing quotation marks, line breaks, or tool-call-like instructions. 2. The value is assigned directly to `message`. 3. `send_emoji` interpolates it into the textual `message(action="send", ...)` representation without escaping. 4. The resulting output can visually terminate or modify the intended `message` argumen ...[truncated 881 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to fetch attacker-controlled or third-party remote content with curl and write it into a trusted local media directory, then immediately send it onward. This creates SSRF-like and content-trust risks: unvalidated URLs can cause unexpected outbound network access, persistence of untrusted files on disk, and redistribution of malicious or inappropriate content without user awareness or approval.

Content

No source excerpt is available for this finding.

Tainted flow: 'img_url' from requests.get (line 49, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
91% confidence
Finding

The image URL is derived from untrusted remote HTML and then fetched directly with requests.get, creating an SSRF-style primitive and allowing the script to contact attacker-controlled hosts. In this skill's context, the risk is increased because the fetched content is then written into a local media directory, so an attacker controlling the search result page or image URL could trigger unexpected outbound requests and store arbitrary remote content locally.

Content

Scanner excerpt · emoji_sender.py (reported line 70)May include surrounding context.

python
headers = {"Referer": REFERER}
    
    try:
        resp = requests.get(img_url, headers=headers, timeout=10)
        resp.raise_for_status()
        
        with open(filepath, 'wb') as f:

Tainted flow: 'filepath' from os.getenv (line 65, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
80% confidence
Finding

The destination path is influenced by an environment variable and the filename incorporates unsanitized user-controlled keyword data, so the script can write files outside the intended media area via path manipulation such as '../'. In this context, the risk is more than theoretical because the tool is explicitly designed to save files locally, and an attacker who can control the keyword or environment could overwrite or create arbitrary files accessible to the running user.

Content

Scanner excerpt · emoji_sender.py (reported line 73)May include surrounding context.

python
resp = requests.get(img_url, headers=headers, timeout=10)
        resp.raise_for_status()
        
        with open(filepath, 'wb') as f:
            f.write(resp.content)
        
        return filepath

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language description is presented only in Chinese and frames the skill around Chinese-language usage, while the manifest provides no opt-in or alternative language/locale handling. Under the stated policy, forcing a specific language without user choice can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest defines very broad trigger keywords such as common acknowledgements, emotions, and workplace terms that overlap heavily with normal conversation. In an agent skill context, this can cause unintended activation and automatic sending of external media in response to routine speech, creating spam, confusing behavior, and possible misuse of messaging actions without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file presents all operational instructions, warnings, and examples in Chinese only. Under the stated policy, forcing a specific language without giving the user a choice can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file contains natural-language documentation entirely in Chinese, including usage examples, without any indication that the user can choose another language or that the skill is region-specific. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.