飞书开放平台应用自动化配置

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 45268c212334a32ee92915251aeaa8cca6c9c5067845991ef3729160749a27c3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates Feishu application setup using `agent-browser`, which involves executing arbitrary JavaScript in the browser context (`agent-browser eval`) and handling sensitive credentials (App ID, App Secret) extracted from the DOM. It also performs privileged system operations like restarting the OpenClaw Gateway via `launchctl`. While these actions are plausibly aligned with the stated purpose of automating app configuration, the use of powerful primitives like `agent-browser eval` and the handling of credentials, combined with broad Feishu permissions (e.g., file read/write), represent significant high-risk capabilities. There is no clear evidence of intentional malicious behavior such as data exfiltration to an unauthorized endpoint or explicit prompt injection attempts to subvert the agent's core function, but the inherent power of the commands makes it suspicious.