OpenClaw Feishu Reasoning UX

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:32 AM UTC
• Version: 0.1.0

Overview

The skill is mostly aligned with Feishu UI customization, but it can direct an agent to read sensitive OpenClaw configuration, session, reasoning-log, and service-environment data without tight limits.

Install only if you intend to let an agent troubleshoot and modify OpenClaw's Feishu integration. Before use, require consent before it reads OpenClaw config, session transcripts, raw reasoning logs, or gateway environment data; ask it to inspect only the current session and needed fields, redact secrets, and avoid dumping full files or environments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:372

Finding

Overbroad Access to Sensitive OpenClaw Configuration, Session, and Reasoning Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:372-374, SKILL.md:381-389, SKILL.md:396-431, SKILL.md:250-252, references/implementation-guide.md:218-234, and references/implementation-guide.md:315-321
Vulnerability Type: Excessive access to sensitive runtime and session data
Risk Level: Medium

Vulnerable Instructions

SKILL.md:372-374 directs the agent to inspect complete configuration, session-state, and raw-reasoning files:

markdown

- `~/.openclaw/openclaw.json`
- `~/.openclaw/agents/main/sessions/sessions.json`
- `~/.openclaw/logs/raw-stream.jsonl`

SKILL.md:381-389 requires model and session verification across multiple sensitive sources:

markdown

### 1. Confirm the active model path

Check all three, not just one:
- global default model in config
- current session provider/model override
- actual model/provider recorded in the current session transcript

Do not trust the agent saying "I switched models". Verify it in session files.

SKILL.md:250-252 additionally instructs comparison of the gateway service environment:

markdown

2. The gateway service environment matches the shell path that was proven to work.
- Proxy-related env differences can make shell tests succeed while live Feishu traffic fails.
- If raw reasoning only works in local CLI tests, compare gateway service env before touching cards.

references/implementation-guide.md:218-234 repeats the requirement to inspect session transcripts and raw-stream logs:

markdown

1. Verify the current Feishu path is really the intended implementation.
   - confirm whether the user is on OpenClaw's built-in Feishu channel
   - do not assume Feishu official plugin behavior is equivalent
2. Verify the current session truly ran on the intended provider/model.
3. Check `raw-stream.jsonl`.
   - If it shows live thinking text events, the model/runtime can support true raw reasoning.
4.
...[truncated 3340 chars]

Remediation

View remediation

Remediation Suggestions

1. Separate workflows by risk:

   • For title, color, card-layout, and other appearance-only changes, explicitly prohibit reading configuration, transcripts, raw-reasoning logs, or service environments.
   • Enable sensitive diagnostics only when evidence indicates a provider, runtime, or session-state problem.

2. Require informed user consent before accessing:

   • session transcripts
   • raw reasoning logs
   • authentication-related configuration
   • gateway service environment variables

3. Replace whole-file inspection with allowlisted extraction:

   • From openclaw.json, read only the active provider and model identifiers.
   • From sessions.json, inspect only the relevant current session and required override fields.
   • From transcripts, extract only provider/model metadata and the presence or absence of a thinking field, not message bodies.
   • From raw-stream.jsonl, search only for required event types and redact event contents unless content inspection is essential.

4. Never dump the complete gateway environment. Query only specifically named non-secret variables needed to diagnose service-path differences.

5. Add mandatory redaction rules for:

   • API keys and bearer tokens
   • cookies and session secrets
   • authorization headers
   • private message bodies
   • unrelated environment variables
   • opaque or encrypted reasoning payloads

6. Require diagnostic reports to describe findings without reproducing raw credentials, transcripts, or reasoning content.

7. Add a data-minimization instruction such as:

markdown

Before reading any OpenClaw configuration, session transcript, reasoning log, or service environment, obtain user consent. Read only the current session and explicitly required fields. Never print secrets, complete transcripts, complete reasoning content, or the full service environment. Redact credentials from all tool output and reports.
``
...[truncated 1 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

md

Required style in those cases:
- do not say "this should be safe" unless it is proven
- do not present a guess as a confirmed root cause
- do not continue directly into runtime/provider/session patching without warning the user

If the user still wants to continue, proceed incrementally and verify after each step.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explicitly recommends handing a GitHub repository URL to OpenClaw so it can read and execute the skill, but it does not warn that repository content is untrusted and may change over time. This creates a supply-chain and remote-content execution risk: a user may cause an agent to fetch and run code or instructions directly from a mutable external source without pinning, review, or trust verification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad, natural-language requests that can easily match ordinary troubleshooting or UX-improvement conversations. In an agentic system that auto-selects skills based on semantic similarity, this can cause the skill to activate outside a narrowly intended scope and modify reply behavior or code paths when the user did not explicitly request this repository-backed customization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples are broad natural-language phrases such as requests to 'help me' improve Feishu replies or explain why Feishu only shows 'Thinking...', which could match ordinary troubleshooting conversations and cause unintended skill activation. In an agent ecosystem, over-broad triggers can route user sessions into repository-reading and customization behavior the user did not explicitly request, increasing the chance of surprising actions or context misuse even though the skill itself is primarily UX-focused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

## Backup and rollback are mandatory

Before any non-trivial Feishu customization, create a recovery trail first.

This is not optional.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 651)May include surrounding context.

md

- forcing reasoning through unrelated block paths without evidence
- storing placeholders in answer lane
- editing only `src/` when runtime actually loads `dist/`
- trusting visual behavior without checking session/runtime logs
- trusting card appearance while ignoring delivery failures

## Validation checklist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/implementation-guide.md (reported line 140)May include surrounding context.

md

For real user environments, especially when touching runtime/session/provider layers, use this protocol:

1. Write down the planned scope
- what behavior is broken
- what is going to be changed
- which files are in scope

Static analysis

No suspicious patterns detected.