Security audit

Feishu Agent Bind

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate routing purpose, but its instructions can rewrite core OpenClaw configuration and delete session data too broadly without adequate safeguards.

Review this skill before installing or following it. Use backups, exact agent and chat identifiers, validated inputs, and official OpenClaw configuration/session commands where available. Do not run the session deletion snippet as written unless you have confirmed the exact files and keys to remove and can restore them if needed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:22
Finding: Unvalidated identifiers enable command and expression injection
Content: View full analysis
") | .workspace' ``` ```bash mkdir -p ~/.openclaw/workspace-/memory ``` ```python if a['id'] == '': a['workspace'] = os.path.expanduser(f'~/.openclaw/workspace-') ``` ```python fs_groups[''] = {'requireMention': False} ``` ```python bindings.append({ "agentId": "", "match": { "channel": "feishu", "peer": {"kind": "group", "id": ""}, "accountId": "" } }) ``` ```bash openclaw config set --json bindings '[...existing..., {"agentId":"","match":{"channel":"feishu","peer":{"kind":"group","id":""},"accountId":"main"}}]' ``` ```bash openclaw sessions --all-agents --json | grep "" ``` ```python keys = [k for k in d if '' in k] ``` ### Technical Analysis The placeholders cross several interpreter boundaries: - `agentId` is inserted into an unquoted shell path. - `agentId` is embedded in a quoted jq expression. - Identifiers are embedded directly in Python string literals. - Binding values are inserted into a shell-quoted JSON document. - `chat_id` is placed inside a double-quoted shell argument. No allowlist validation, encoding, or context-specific parameter passing is prescribed. If an identifier includes shell metacharacters, quotes, command substitutions, jq syntax, Python syntax, path traversal components, or JSON delimiters, it can change how the supplied command is interpreted. These are documentation templates rather than automatically invoked scripts, so exploitation requ ...[truncated 1542 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:82
Finding: Broad substring-based session deletion can remove unrelated records and corrupt session stores
Content: View full analysis
' in k] if keys: for k in keys: del d[k] with open(f,'w') as fh: json.dump(d, fh) print(f'Cleaned {f}: {keys}') " ``` ### Technical Analysis The deletion predicate uses substring containment: ```python '' in k ``` It does not compare against a canonical, exact session key. Consequently, a short, partial, overlapping, or otherwise ambiguous identifier can match unrelated sessions. The code also: - Searches session stores belonging to every agent. - Performs no preview or operator confirmation before deletion. - Creates no backup. - Does not coordinate with the gateway through a lock or shutdown procedure. - Opens each original file with mode `w`, truncating it before serialization completes. - Does not use an atomic temporary-file replacement. If execution is interrupted, serialization fails, or another process writes concurrently, the entire `sessions.json` file can become truncated, stale, or malformed. ### Attack Path 1. A stale-session cleanup is initiated using an ambiguous, partial, or attacker-influenced chat ID. 2. The script traverses `~/.openclaw/agents/*/sessions/sessions.json`. 3. Substring matching selects session keys that merely contain the supplied text, including unrelated keys. 4. Those records are deleted without confirmation. 5. Each original store is directly truncated and rewritten. 6. Unrelated sessions are lost; interruption or concurrent gateway activity can additionally corrupt a complete sessio ...[truncated 546 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:33
Finding: Non-atomic central configuration rewrite can corrupt OpenClaw configuration
Content: View full analysis
': a['workspace'] = os.path.expanduser(f'~/.openclaw/workspace-') break with open(os.path.expanduser('~/.openclaw/openclaw.json'), 'w') as f: json.dump(c, f, indent=2, ensure_ascii=False) ``` A later standalone block assumes the previous block's in-memory variable remains available: ```python # Add group config fs_groups = c['channels']['feishu'].setdefault('groups', {}) fs_groups[''] = {'requireMention': False} ``` ### Technical Analysis The first snippet calls `os.path.expanduser` without importing `os`, causing a `NameError` when followed literally in a fresh Python interpreter. The later snippet relies on `c` having been initialized by the preceding block, even though it is presented as a separate fenced example. More importantly, the central configuration file is opened directly with mode `w`. Opening in this mode truncates the original before the updated JSON has been fully serialized. The procedure provides no: - Configuration backup. - Schema validation. - File lock or gateway coordination. - Error-safe rollback. - Atomic replacement. - Verification that the target agent was found before writing. A process interruption, storage error, serialization failure, or concurrent configuration writer can therefore leave the main OpenClaw configuration empty, partial, malformed, or semantically incorrect. ### Attack Path 1. An operator follows the documented configuration update. 2. The example may initially fail because `os` is not imported, encouraging manual modi ...[truncated 1068 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
openclaw config get agents.list | jq '.[] | select(.id=="") | .workspace'

text
If workspace is shared with main (`~/.openclaw/workspace`), create a dedicated one: ```bash mkdir -p ~/.openclaw/workspace-<agentId>/memory

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the operator to directly modify and delete entries from session storage files based on a substring match, with no backup, dry-run, confirmation, or scope validation. This can destroy conversation state for the wrong agent or multiple sessions accidentally, causing irreversible data loss and operational disruption.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.