feishu-create-openclaw-app

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:39 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it asks an agent to grant broad Feishu access and print an app secret in chat, so it needs review before use.

Install only if you are comfortable granting a newly created Feishu app broad tenant-level permissions. Before use, reduce the scope list to the permissions your integration actually needs, have an administrator review them, and do not let the agent print the full App Secret into chat or logs; copy it directly into a secure configuration or secret manager instead.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:59

Finding

Overly Broad Feishu Application Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-87
Vulnerability Type: Excessive application permissions
Risk Level: High

Vulnerable Code

json

{
  "scopes": {
    "tenant": [
      "aily:file:read",
      "aily:file:write",
      "application:application.app_message_stats.overview:readonly",
      "application:application:self_manage",
      "application:bot.menu:write",
      "cardkit:card:write",
      "contact:user.employee_id:readonly",
      "corehr:file:download",
      "docs:document.content:read",
      "event:ip_list",
      "im:chat",
      "im:chat.access_event.bot_p2p_chat:read",
      "im:chat.members:bot_access",
      "im:message",
      "im:message.group_at_msg:readonly",
      "im:message.group_msg",
      "im:message.p2p_msg:readonly",
      "im:message:readonly",
      "im:message:send_as_bot",
      "im:resource",
      "sheets:spreadsheet",
      "wiki:wiki:readonly"
    ],
    "user": [
      "aily:file:read",
      "aily:file:write",
      "im:chat.access_event.bot_p2p_chat:read"
    ]
  }
}

Technical Analysis

The Skill instructs the Agent to bulk-import a fixed collection of tenant-wide and user-level permissions. These include file reading and writing, HR file downloads, document access, chat and message access, spreadsheet access, wiki access, bot message sending, and application self-management.

The stated purpose is creating a Feishu application for an OpenClaw integration, but the Skill does not associate each permission with a required feature or restrict the permission set according to the user's intended functionality. Automatically requesting the complete set breaks the principle of least privilege.

This issue does not independently bypass Feishu's authorization controls: the requested scopes may still require user or administrator approval. However, the automated workflow encourages approval of a broad per ...[truncated 1455 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the fixed permission bundle with a minimal baseline containing only scopes required for core functionality.
2. Document the feature that requires each scope and remove any scope without a demonstrated operational dependency.
3. Make sensitive capabilities, such as HR file downloads, file writes, complete message access, and application self-management, individually optional.
4. Present the final scope list and its security implications to the user before importing or submitting it.
5. Require explicit confirmation before requesting tenant-wide or write-capable permissions.
6. Separate read-only and write-enabled deployment profiles.
7. Provide deployment-specific permission manifests so installations do not receive capabilities for disabled features.
8. Periodically audit granted permissions and revoke unused scopes.
9. Ensure tenant administrators independently review the requested scopes before approval.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:123

Finding

Full Application Secret Is Revealed and Printed in Agent Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:123-125
Vulnerability Type: Plaintext credential exposure
Risk Level: High

Vulnerable Code

markdown

## Step 6: Extract Credentials

Navigate to the credentials and basic information page.

- **App ID**: Visible directly (for example, `cli_xxxxxxxxxxxx`)
- **App Secret**: Click the eye icon to reveal it and display the full secret to the user

The excerpt above is an English rendering of the instruction at the cited source location. The source explicitly requires revealing and displaying the complete application secret.

Technical Analysis

The Skill instructs the Agent to reveal the Feishu App Secret in the browser and reproduce the full credential in its response. This places a long-lived authentication secret into the Agent's output channel.

Agent responses may be retained in conversation history, application logs, observability systems, browser automation recordings, screenshots, telemetry, or downstream processing systems. Those systems may have broader access controls and longer retention periods than a dedicated secret manager. Displaying the full credential consequently expands its exposure surface and makes accidental disclosure significantly more likely.

The risk is amplified by the broad application scopes requested elsewhere in the Skill. Anyone who obtains the App Secret and corresponding App ID may be able to authenticate as the application, subject to Feishu's authentication rules and any additional controls.

Attack Path

1. The Agent creates the Feishu application.
2. The Agent opens the credentials page and clicks the control that reveals the App Secret.
3. The Agent reads and inserts the full secret into its response.
4. The response or browser session is retained in chat history, logs, telemetry, screenshots, recordings, or another downstream system.
5. A person or compromised service with access to one of those syste ...[truncated 900 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to display the full App Secret in Agent output.
2. Instruct the user to transfer the secret directly from Feishu into an approved secret manager or protected configuration interface.
3. Never place the secret in chat messages, logs, screenshots, browser snapshots, command history, or telemetry.
4. Mask secret confirmations, showing only a short non-sensitive suffix when verification is necessary.
5. Ensure browser automation does not capture the page while the secret is visible.
6. Restrict access to the credential page and require explicit user interaction before revealing sensitive values.
7. Rotate the App Secret immediately if it has already appeared in Agent output or retained automation artifacts.
8. Apply short retention periods and sensitive-data redaction to Agent and browser automation logs.
9. Keep the application's permissions minimal so that credential compromise has a reduced blast radius.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill directly instructs the agent to reveal the App Secret and display the full credential to the user. This is dangerous because agent outputs are commonly persisted in conversation history, telemetry, logs, screenshots, or shared workspaces, turning a one-time secret into a broadly exposed credential that can be abused to impersonate the application.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The sample success output includes a placeholder for the full App Secret, which normalizes secret disclosure as expected behavior and encourages insecure implementations. In context, this is especially risky because the skill is designed for automated browser workflows, where transcripts and UI captures can retain sensitive credentials beyond their intended one-time display window.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to reveal and display a full App Secret to the user, but provides no guidance on minimizing exposure, masking, secure transfer, or warning that the credential is highly sensitive. In a browser-automation skill, normalizing direct secret disclosure increases the chance the secret is exposed in logs, screenshots, chat history, or to unintended viewers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file requires interaction with Chinese UI labels such as "创建企业自建应用", "权限管理", and provides final output text in Chinese. This imposes a specific language/locale on the user without opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.