T09 · Insecure Skill Coding Practices
Error
- Location
get_feishu_token.sh:4- Finding
Hard-Coded Feishu Application Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Upload Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill’s Feishu upload purpose is clear, but it needs review because it bundles credentials, exposes tokens, stores them insecurely, and can perform network side effects during installation.
Review before installing. Only use this with a Feishu app you control, rotate the bundled secret if it is real, remove token/log disclosure, store credentials in a proper secret store, and disable installation-time token retrieval or upload tests unless the user explicitly opts in.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
get_feishu_token.sh:17- Finding
Bearer Tokens Disclosed Through Logs and Insecure Local Storage
- Content
View full analysis
/home/node/.openclaw/workspace/feishu_token.txt ``` Additional token-prefix disclosure: ```javascript const accessToken = fs.readFileSync(tokenFile, 'utf8').trim(); console.log('使用访问令牌:', accessToken.substring(0, 30) + '...'); ``` ```bash ACCESS_TOKEN=$(cat "$TOKEN_FILE" | tr -d '\n') echo "使用访问令牌: ${ACCESS_TOKEN:0:30}..." ``` ### Technical Analysis The token endpoint response is printed in full. A successful Feishu response can contain the complete `tenant_access_token`, so line 17 may disclose the entire bearer credential to standard output. The script then prints up to 50 token characters, while four additional upload implementations print 30-character token prefixes. Output may be retained in terminal logs, CI/CD records, OpenClaw transcripts, support bundles, or redirected debug files. Even where a prefix is not independently usable, exposing substantial credential material is unnecessary and weakens confidentiality. The complete token is also written as plaintext to a fixed workspace path without an explicit restrictive `umask` or file mode. Its effective permissions therefore depend on the process environment. On a multi-user or shared environment, another local principal may be able to read it. ### ...[truncated 920 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
feishu_upload_simple.sh:53- Finding
Bearer Token and File Forwarded to an Unvalidated Upload URL
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
simple_feishu_upload.js:47- Finding
Undeclared and Unpinned Runtime Dependency
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
install.sh:78- Finding
Installer Can Perform an Undocumented Authenticated File Upload
- Content
View full analysis
"$TEST_FILE" echo "安装时间: $(date)" >> "$TEST_FILE" echo -e "\n🧪 测试技能功能..." cd "$TARGET_DIR" # 测试上传功能（不上传，只检查） echo "测试上传工具..." if node feishu_complete_upload.js --help 2>&1 | grep -q "用法"; then echo "✅ 上传工具测试通过" else # 尝试运行工具 if node feishu_complete_upload.js test_install.txt 2>&1 | grep -q "上传成功"; then echo "✅ 上传功能测试通过" else echo "⚠️ 上传功能测试未完成，但工具可以运行" fi fi ``` ### Technical Analysis The installer states that its test will not upload data, but `feishu_complete_upload.js` does not implement a `--help` option. It treats its first argument as a file path. Unless a file literally named `--help` exists, the first condition fails and execution reaches the fallback. The fallback invokes the real uploader with `test_install.txt`. If a token is available and the Feishu API is reachable, the installer performs an authenticated external write and uploads a generated file containing the installation timestamp. Network uploads are part of the Skill's normal runtime functionality, but they are not required merely to install the Skill. Performing one without explicit consent exceeds the minimum side effects needed for installation. ### Attack Path 1. A user runs `install.sh`. 2. The installer creates `test_install.txt`. 3. It calls the uploader with `--help`, which is interpreted as a nonexistent path rather than a help flag. 4. The conditional check fails. 5. The fallback invokes the uploader with `test_install.txt`. 6. The file is uploaded to Feishu using the workspace bearer token. ### Impact Assessment The direct data exposure is limited to the generated test text and installation timestamp. The more significant concern is that installation unexpectedly uses a ...[truncated 277 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (35)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script reads a bearer token from disk and then echoes part of it to stdout. Even partial credential disclosure is sensitive because logs, terminals, CI output, or shell history can expose enough information to aid token theft correlation or reveal secrets to unintended viewers.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The line prints the access token prefix directly to stdout. Console output is commonly captured by logs, orchestration systems, remote terminals, and transcripts, so this creates a straightforward credential exposure path.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script explicitly exposes sensitive authentication material in user-visible output via
echo "使用访问令牌: ${ACCESS_TOKEN:0:30}...". Bearer tokens are secrets; exposing even a large prefix materially increases risk of token leakage through logs, screenshots, terminal scrollback, and monitoring systems.- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # 获取访问令牌 echo -e "\n获取访问令牌..." RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json; charset=utf-8" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # 测试使用令牌访问API echo -e "\n测试API访问..." TEST_RESPONSE=$(curl -s -X GET \ "https://open.feishu.cn/open-apis/drive/v1/files" \ -H "Authorization: Bearer $TOKEN")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes uploading arbitrary local files and sending them to Feishu chats, including examples like memory archives, but provides no warning that this transmits local data to a third-party service. In an agent-skill context, this increases the risk of accidental exfiltration of sensitive workspace data, credentials, logs, or memory artifacts by users who may treat the skill as a routine utility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is explicitly designed to upload a local file to Feishu cloud storage and optionally send it into a chat, but the description presents this as a convenience feature without a prominent warning about external data transmission. In an agent or tool ecosystem, this increases the risk that a user or downstream caller triggers exfiltration of sensitive local files without fully understanding that data leaves the local environment and is delivered to a third-party service and chat recipients.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript example presents its title, comments, and console-facing instructional output in Chinese, which effectively forces a specific language for users. The file does not offer any user opt-in, alternative locale, or justification that the skill is intentionally region-specific.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script reads an arbitrary local file and uploads its full contents to Feishu, but provides no explicit consent prompt, destination confirmation, or safeguards against accidental exfiltration of sensitive data. In an agent-skill context, this is risky because a caller may trigger external transmission of workspace files using a stored access token with little user awareness beyond console output.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This code performs a network POST to Feishu with file data and an authorization token, creating a direct external data transmission path. While the functionality appears intended, it is still a real security concern because it enables exporting local data to a third-party service without validation of whether the file contents are appropriate to leave the local environment.
- Content
js console.log(' 正在上传...'); // 上传文件 const response = await fetch('https://open.feishu.cn/open-apis/im/v1/files', { method: 'POST', headers: { 'Authorization': `Bearer ${accessToken}`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script performs an HTTP file upload to Feishu using curl, transmitting the specified local file and related metadata to an external service. While the script prints operational status, it does not clearly warn the user that local file contents will be sent off-host, which is a privacy-relevant action.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # 对于小文件，可能只需要一个块 echo -e "\n3. 上传文件块..." # 这里简化处理，假设文件小于块大小 UPLOAD_PART_RESPONSE=$(curl -s -X PUT \ "https://open.feishu.cn/open-apis/drive/v1/files/upload_part" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: $MIME_TYPE" \
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script reads a bearer token from disk and prints the first 30 characters to stdout. Even partial bearer-token disclosure is dangerous because terminal logs, CI output, shell history captures, or shared sessions can expose enough secret material to aid credential theft or correlate the exact token in use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All user-facing messages, usage instructions, and status output are written in Chinese, with no indication that the skill is region-specific or that users may select another language. This can violate language/locale policy when a skill imposes a single language without opt-in or justification.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi PAYLOAD="${PAYLOAD}}" PREPARE_RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/drive/v1/files/upload_prepare" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json; charset=utf-8" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi PAYLOAD="${PAYLOAD}}" PREPARE_RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/drive/v1/files/upload_prepare" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json; charset=utf-8" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "第二步：上传文件内容..." MIME_TYPE=$(file --mime-type -b "$FILE_PATH" || echo "application/octet-stream") UPLOAD_RESPONSE=$(curl -s -X PUT \ "$UPLOAD_URL" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: $MIME_TYPE" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
These lines send the selected local file to a remote upload URL using curl, which transmits user data off-system. Although the script logs progress, it does not clearly warn the user that file contents and related metadata will be sent to Feishu, and the skill purpose is not otherwise documented here.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # 第三步：完成上传 echo "第三步：完成上传..." FINISH_RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/drive/v1/files/upload_finish" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json; charset=utf-8" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This curl command sends sensitive authentication material to an external network endpoint. While contacting Feishu's auth API is expected for token retrieval, the operation still constitutes external transmission of credentials and becomes dangerous because the secrets are hardcoded and the action occurs automatically.
- Content
sh # 获取访问令牌 echo -e "\n获取访问令牌..." RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json; charset=utf-8" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits hardcoded application credentials to an external service without any interactive warning, confirmation, or secure secret handling. Because the APP_ID and APP_SECRET are embedded directly in the script, anyone with access to the file can recover and reuse them, and execution immediately sends them over the network to obtain a tenant token.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script persists the bearer token to a predictable local file path in plaintext, creating a reusable credential artifact on disk. Any local user, process, backup system, or later workflow that can read that file may reuse the token to access Feishu resources until it expires or is revoked.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
After obtaining a valid tenant access token, the script performs an additional authenticated Feishu Drive API request unrelated to mere token retrieval. This expands the script's behavior from credential acquisition to active use of the token against another service, which increases the risk of unintended data access and normalizes post-authentication probing without user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
When no cached token file exists, the installer automatically runs get_feishu_token.sh, which obtains credentials without asking the user for confirmation. Triggering credential acquisition during installation can unexpectedly access secrets, initiate network authentication flows, or persist sensitive tokens on disk without the operator knowingly approving that behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script states that it will only test the upload tool without uploading, but its fallback branch actually invokes the uploader on a real file and treats "上传成功" as a valid outcome. This is dangerous because installers are expected to be side-effect-minimal; here the install process may silently send data to an external Feishu destination, causing unintended data transmission and violating user expectations.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- example.js:29
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- feishu_complete_upload.js:17
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- native_feishu_upload.js:21
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- simple_feishu_upload.js:17