ClawHub
Back to skill

Security audit

Feishu Card Design 飞书卡片消息设计规范

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly a Feishu card-formatting toolkit; it includes disclosed sending examples that should be used carefully, but I found no hidden runtime network or credential behavior.

Install this as a card design and validation skill, not as an automatic sender. If you copy the Feishu OpenAPI examples, keep app credentials in a secrets manager, validate recipients and URLs, minimize card content, and require explicit approval before sending messages externally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The README includes concrete Feishu authentication and message-delivery code even though the skill is described as spec-only and explicitly not for directly sending Feishu messages. In an agent-skill context, this can cause downstream agents or users to treat the skill as authorized to exfiltrate generated content to an external service, expanding capability beyond the declared trust boundary.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The file claims the skill is spec-only with no business logic, but elsewhere provides operational code for token acquisition and message sending. This mismatch is dangerous because security reviewers and agent operators may under-scope the skill's effective behavior, leading to unsafe enablement of networking or secret use under a misleading description.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The README explicitly frames the skill as a pure design/specification artifact that does not send Feishu messages, but elsewhere it includes concrete API code for authenticating and sending IM cards. This mismatch can mislead operators into granting the skill more trust or broader use than intended, increasing the chance that network-capable behavior is adopted without proper review.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill includes network-capable Feishu OpenAPI usage even though the stated purpose is only card design/specification. In an agent ecosystem, examples often get copied into automation flows, so including outbound messaging logic expands the operational scope from passive formatting guidance to active data transmission.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The documentation claims there is no business logic, yet later provides executable business logic for token retrieval and message sending. That inconsistency undermines reviewer expectations and can cause downstream systems to import or trust the skill under a false assumption that it is non-operational.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The checklist says legal header.template values include "wheat", while earlier sections define supported values such as turquoise, blue, green, indigo, violet, red, and note yellow should not be used as a header. This inconsistency can mislead implementers into emitting invalid or unintended card schema values, causing rendering errors or broken downstream validation, though it does not directly enable code execution or privilege abuse.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The file is declared as a pure rendering/specification skill, yet it embeds executable message-sending fallback logic that performs outbound actions. This creates a capability mismatch: an integrating agent may copy or operationalize the example as endorsed behavior, causing the skill to exceed its stated scope and directly send messages in contexts where only formatting guidance was expected.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This template embeds clickable open_url behaviors, which introduces operational capability in a skill described as a pure card-design/specification resource. If downstream systems render and send this template without strict URL validation, users can be directed to arbitrary external destinations, enabling phishing, tracking, or unsafe workflow redirection.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The template contains both a hardcoded external URL and a parameterized URL placeholder, neither of which is justified by the stated non-operational scope of the skill. The parameterized {{文档URL}} is especially risky because untrusted input could populate it with attacker-controlled destinations, turning a design artifact into a phishing or exfiltration vector when deployed.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The template metadata explicitly instructs consumers to copy the file, replace placeholders, and call the Feishu OpenAPI to send a message, which contradicts the skill’s stated scope as a pure specification skill that does not send messages. This creates a scope-confusion hazard: downstream agents may treat the skill as authorizing outbound messaging behavior and chain it into message-sending workflows without appropriate gating or policy checks.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The template embeds a primary action button labeled to open a cloud document, even though the skill description explicitly says it must not be used for Feishu cloud document editing or related document operations. In agent ecosystems, actionable links are operational behavior, not just presentation; this can enable policy-bypassing workflows, misleading users about approved capabilities, and directing recipients to attacker-controlled or unauthorized document URLs.

External Transmission

Medium
Category
Data Exfiltration
Content
def send_card(card: dict, user_open_id: str, app_id: str, app_secret: str):
    # 1. Get tenant_access_token
    resp = requests.post(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        json={"app_id": app_id, "app_secret": app_secret},
        timeout=15,
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
"msg_type": "interactive",
        "content": json.dumps(card, ensure_ascii=False),
    }
    resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
        headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
        json=msg,
Confidence
90% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def send_card(card: dict, user_open_id: str, app_id: str, app_secret: str):
    # 1. Get tenant_access_token
    resp = requests.post(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        json={"app_id": app_id, "app_secret": app_secret},
        timeout=15,
Confidence
88% confidence
Finding
requests.post( "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", json=

External Transmission

Medium
Category
Data Exfiltration
Content
"msg_type": "interactive",
        "content": json.dumps(card, ensure_ascii=False),
    }
    resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
        headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
        json=msg,
Confidence
90% confidence
Finding
requests.post( "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id", headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"}, json

External Transmission

Medium
Category
Data Exfiltration
Content
def send_card(card: dict, user_open_id: str, app_id: str, app_secret: str):
    # 1. 获取 tenant_access_token
    resp = requests.post(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        json={"app_id": app_id, "app_secret": app_secret},
        timeout=15,
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
"msg_type": "interactive",
        "content": json.dumps(card, ensure_ascii=False),
    }
    resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
        headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
        json=msg,
Confidence
89% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def send_card(card: dict, user_open_id: str, app_id: str, app_secret: str):
    # 1. 获取 tenant_access_token
    resp = requests.post(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        json={"app_id": app_id, "app_secret": app_secret},
        timeout=15,
Confidence
88% confidence
Finding
requests.post( "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", json=

External Transmission

Medium
Category
Data Exfiltration
Content
"msg_type": "interactive",
        "content": json.dumps(card, ensure_ascii=False),
    }
    resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
        headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
        json=msg,
Confidence
89% confidence
Finding
requests.post( "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id", headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"}, json

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.