Security audit

Feishu Doc Collab

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about automatic Feishu document collaboration, but it patches trusted OpenClaw code and lets shared document edits trigger authenticated agent actions with limited scoping.

Install only after reviewing the patch and limiting deployment to explicitly approved Feishu documents and Bitable bases. Use the narrowest OAuth scopes available, avoid exposing unrelated tools to the hook-triggered agent, add audit logging and approval gates for writes, and prefer a supported extension mechanism over replacing OpenClaw monitor code.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: references/monitor-full-patched.js:97
Finding: Untrusted Feishu document content is processed as an autonomous agent task
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/patch-monitor.sh:45
Finding: Patch script replaces the installed Feishu monitor without version or integrity validation
Content: View full analysis
/dev/null && grep -q "_editDebounce" "$MONITOR" 2>/dev/null; then echo "monitor already patched (hooks + debounce) - no changes needed." exit 0 fi echo "Applying feishu-doc-collab patch..." echo " Agent name: $AGENT_NAME" cp "$MONITOR" "$MONITOR.bak" echo " Backup saved: $MONITOR.bak" # Use the full patched reference file REF="$SKILL_DIR/references/monitor-full-patched.js" if [ -f "$REF" ]; then cp "$REF" "$MONITOR" ``` ### Technical Analysis The installation script does not apply a narrow patch to the existing monitor. It replaces the entire trusted OpenClaw Feishu monitor with a fixed JavaScript file bundled by the Skill. No target version, source hash, compatibility, syntax, ownership, or signature check is performed. The same replacement is attempted for both: - A JavaScript monitor in the `openclaw-lark` extension. - A TypeScript monitor in an older built-in extension. The documentation instructs users to reapply this replacement after OpenClaw or extension updates. Doing so can erase upstream security fixes and functionality introduced by those updates. Copying JavaScript content over a TypeScript target may also create compatibility or service-availability problems. The backup name is fixed as `monitor.js.bak` or `monitor.ts.bak`. Repeated successful patch cycles can overwrite the previously known-good backup after an upstream update. ### Attack Path 1. OpenClaw or its Feishu extension is updated with security or behavior changes. 2. The user follows the Skill's documented instruction to rerun `patch-monitor.sh`. 3. The script locates the updated monitor but does not verify its version or hash. 4. The complete updated monitor is replaced with the Skill's fixed reference copy. 5. Upstream fixes or compatibili ...[truncated 813 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/monitor-full-patched.js:66
Finding: Unbounded debounce map allows persistent memory growth
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/feishu-app-setup.md:25
Finding: Setup guidance requests a broader Drive permission than the documented read-only scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
- The `name: "DocCollab"` field helps identify hook sessions in logs - For .js files (openclaw-lark), no jiti cache clearing is needed - For .ts files (older installs), clear jiti cache after patching: `rm -f /tmp/jiti/src-monitor.*.cjs` ## Required Feishu App Permissions

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/manual-patch.md (reported line 53)May include surrounding context.
md
- The `name: "DocCollab"` field helps identify hook sessions in logs - For .js files (openclaw-lark), no jiti cache clearing is needed - For .ts files (older installs), clear jiti cache after patching: `rm -f /tmp/jiti/src-monitor.*.cjs` ## Required Feishu App Permissions

Ssd 1

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code embeds a natural-language prompt that instructs an agent to read a workspace file (DOC_PROTOCOL.md), fetch external document content, interpret it as conversation state, and conditionally write back to the document. This makes autonomous agent behavior depend on untrusted content and prompt instructions generated by an event bridge, which is a classic prompt-injection/enforced-agent-action risk that can lead to unauthorized reads, writes, or workflow manipulation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents behavior that reads documents, makes network calls, reuses OAuth-backed access, and triggers hook sessions, but it declares no explicit tool scope or allowed-tools boundary. That mismatch weakens user and platform control over what the skill can access, increasing the risk of unintended document access, outbound requests, and privilege misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description promotes real-time collaboration but does not prominently warn that every qualifying edit can cause the agent to read document contents and append replies automatically. This is risky because users may expose sensitive business content without realizing that edits trigger automated processing and modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad and include generic document-collaboration terms that could cause the skill to be suggested or activated in many ordinary editing contexts. In a skill that auto-reads and auto-modifies documents on edit events, overly broad triggering raises the chance of unintended invocation and surprise data processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill lists multiple powerful OAuth scopes and notes token reuse for isolated sessions, but it does not clearly warn that these credentials grant access to organizational documents and records. Without explicit sensitivity guidance, operators may over-provision scopes or deploy the skill without understanding the account-access and data-exposure implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document is titled entirely in Chinese ("飞书文档对话协议") while the rest of the template is largely in English, indicating a locale-specific requirement without any user opt-in or explanation. This matches the policy concern for natural-language locale constraints that are imposed rather than offered as a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The protocol explicitly instructs the AI to automatically open linked documents, process content, and update Bitable records, but it does not require any user-visible notice, confirmation, or approval before modifying shared artifacts. In a collaborative document/task system, this can cause unintended edits, silent workflow changes, and trust/confusion issues, especially when a linked document or task is triggered by another user or by malformed/unexpected content.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manual patch explicitly registers a drive.file.bitable_record_changed_v1 handler in addition to document edit events, expanding the trigger surface beyond the stated document-collaboration use case. That broader event subscription can cause unintended monitoring or processing of spreadsheet/bitable changes, increasing data exposure and the chance of surprising autonomous agent execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The guide instructs users to manually modify installed extension files under user or system paths and clear runtime cache, but does not warn about integrity, persistence, upgrade breakage, or the security implications of patching production code. Manual source patching of installed components is risky because it bypasses normal package verification and makes it easy to introduce or conceal malicious behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document-edit handler reads a local OpenClaw config file from the host filesystem to extract a hooks bearer token, then uses that secret to invoke a separate localhost agent endpoint. This expands the skill from Feishu event handling into privileged local orchestration and secret consumption, creating a trust-boundary violation: untrusted document edits can indirectly trigger local agent actions using host-resident credentials.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The multi-step instruction block presents several benign-looking checks before authorizing a final feishu_update_doc action, which normalizes a pattern where the agent is expected to decide and perform writes based on document-controlled metadata. Even with gating rules, an attacker who can shape document content or protocol markers may steer the agent into taking unintended actions, especially because the validation is delegated to the agent rather than enforced in trusted code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script unconditionally replaces a core extension source file with a bundled reference file after creating a backup, without prompting the user or verifying that the replacement matches the installed extension version. This can silently alter system behavior, break the target integration, or introduce malicious logic if the skill package is tampered with, especially because it patches code in a user or system extension path.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The inline documentation labels this section as handling 'Document edit events' and notes that read events are intentionally ignored. However, the code also routes 'drive.file.bitable_record_changed_v1' into the same handler, which broadens behavior beyond document edits into Bitable task-board changes. This is a documentation-to-code divergence because the comment describes a narrower event scope than what is actually handled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment on L136 is written in Chinese with no alternative language or indication that language choice is configurable. This can violate a language/locale policy when the skill is expected to be usable by broader teams without requiring a specific language.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: references/monitor-full-patched.js:89

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: references/monitor-full-patched.js:89