Back to skill

Security audit

Feishu Evolver Wrapper (Fixed)

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent Feishu/evolver wrapper purpose, but it grants broad autonomous execution, persistence, Git publishing, package installation, and reporting powers that are under-scoped and under-disclosed.

Install only if you explicitly want a long-running autonomous evolver wrapper that can restart itself, spawn agents, send Feishu reports, alter sibling skills, install dependencies, and push workspace state to Git. Review and disable the watchdog, Git sync, auto-heal, hint injection, and raw log/file export paths before using it in a workspace with secrets or private memory.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)

T06 · System Persistence

Error
Location
lifecycle.js:309
Finding

Persistent watchdog survives normal stop operations

Content
View full analysis
j.name === 'evolver_watchdog_robust'); if (!exists) { console.log('[Lifecycle] Creating missing cron job: evolver_watchdog_robust...'); const cmdStr = `${openclawCli} cron add --name "evolver_watchdog_robust" --every "30m" --session "isolated" --message "exec: node skills/feishu-evolver-wrapper/lifecycle.js ensure" --no-deliver`; execSync(cmdStr, { windowsHide: true }); console.log('[Lifecycle] Watchdog cron job created successfully.'); } else { if (exists.enabled === false) { console.log(`[Lifecycle] Enabling disabled watchdog job (ID: ${exists.id})...`); execSync(`${openclawCli} cron edit "${exists.id}" --enable`, { windowsHide: true }); } if (exists.schedule && exists.schedule.everyMs === 600000) { console.log(`[Lifecycle] Optimizing watchdog frequency to 30m (ID: ${exists.id})...`); execSync(`${openclawCli} cron edit "${exists.id}" --every "30m"`, { windowsHide: true }); } } ``` ```js function start(args) { const pid = getRunningPid(); if (pid) { console.log(`Evolver wrapper is already running (PID ${pid}).`); return; } ensureWatchdog(); console.log('Starting Evolver Wrapper...'); const out = fs.openSync(path.resolve(__dirname, '../../logs/wrapper_out.log'), 'a'); const err = fs.openSync(path.resolve(__dirname, '../../logs/wrapper_err.log'), 'a'); const child = spawn('node', [WRAPPER_INDEX, ...args], { detached: !IS_WIN, stdio: ['ignore', out, err], cwd: __dirname, windowsHide: true }); fs.writeFileSync(PID_FILE, String(child.pid)); child.unref(); console.log(`Started background process (PID ${child.pid}).`); } ``` ```js function stop() { const pid = getRunningPid(); ...[truncated 2558 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:1198
Finding

Arbitrary JavaScript evaluation from delegated Agent output

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skills_monitor.js:59
Finding

Health reporting executes sibling Skill entry points

Content
View full analysis
0) { if (!fs.existsSync(path.join(skillPath, 'node_modules'))) { // Try to actually require the entry point to see if it works without node_modules var entryAbs = path.join(skillPath, mainFile); if (fs.existsSync(entryAbs) && mainFile.endsWith('.js')) { try { execSync(`node -e "require('${entryAbs.replace(/'/g, "\\'")}')"`, { stdio: 'ignore', timeout: 5000, cwd: skillPath, windowsHide: true }); // require succeeded: deps are resolved via relative paths or globals, no issue } catch (e) { issues.push('Missing node_modules (needs npm install)'); } } } } ``` The report path invokes the monitor: ```js const issues = runSkillsMonitor(); ``` ### Technical Analysis Importing a Node.js entry point is an execution operation, not a passive dependency check. Every module-level statement in the target Skill runs when `require(entryAbs)` is evaluated. The reporting workflow scans all non-ignored sibling Skills. Therefore, sending an otherwise ordinary status report may execute unrelated Skill code. The command is launched under the wrapper’s account and inherits its operational environment. ### Attack Path 1. An attacker places or compromises a sibling directory under the shared Skills directory. 2. The Skill has a `package.json`, dependencies, no local `node_modules`, and a JavaScript entry point containing malicious module-level code. 3. A user or automated cycle generates a report. 4. `report.js` invokes `runSkillsMonitor()`. 5. The monitor runs `node -e "require(...)"` for the malicious entry point. 6. The entry poin ...[truncated 380 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
skills_monitor.js:104
Finding

Report generation can silently install third-party dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lifecycle.js:213
Finding

Environment-controlled OpenClaw path enables shell command injection

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
index.js:560
Finding

Automated Git synchronization publishes broad workspace state

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
export_history.js:22
Finding

Feishu export and reporting use incomplete secret-leakage controls

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (67)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A weekly event-log analysis tool mislabeled as a daemon-management/reporting wrapper is primarily a transparency and consent problem. The danger comes from operators granting trust and permissions for one function while the skill reads local event/log data for a different purpose.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · export_history.js (reported line 12)May include surrounding context.

js
const WORKSPACE_ROOT = path.resolve(__dirname, '../..');
try {
    require('dotenv').config({ path: path.join(WORKSPACE_ROOT, '.env') });
} catch (e) {}

const DOC_TOKEN = process.env.FEISHU_EVOLVER_DOC_TOKEN || '';

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · visualize_dashboard.js (reported line 14)May include surrounding context.

js
const WORKSPACE_ROOT = path.resolve(__dirname, '../..');
try {
    require('dotenv').config({ path: path.join(WORKSPACE_ROOT, '.env') });
} catch (e) {}

const DOC_TOKEN = process.env.FEISHU_EVOLVER_DOC_TOKEN || '';

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · export_history.js (reported line 24)May include surrounding context.

js
let token;
    try { token = JSON.parse(fs.readFileSync(TOKEN_FILE)).token; } catch(e) {}
    if (!token) return console.error("Error: No Feishu access token in " + TOKEN_FILE);

    let logContent = '';
    try { logContent = fs.readFileSync(LOG_FILE, 'utf8'); } catch(e) { return console.error("No log file: " + LOG_FILE); }

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The wrapper’s stated role is Feishu lifecycle/reporting, but this code stages files, commits, rebases, and pushes to origin/main automatically. That expands the skill from observer/orchestrator into an autonomous repo mutator with network side effects, which can unintentionally publish unsafe code, overwrite history context, or exfiltrate sensitive repository contents to a remote.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The 'Thought Injection' feature reads arbitrary text from a filesystem file and turns it into EVOLVE_HINT, explicitly steering later agent behavior. In this context, any actor able to write that file gains an indirect command channel into the autonomous agent loop, enabling prompt injection, sabotage, or stealthy task redirection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code falls back to new Function('return (' + sanitized + ')')() to parse a sessions_spawn payload when JSON parsing fails. Because the payload is derived from child process output treated as potentially adversarial, this is arbitrary code execution inside the wrapper process.

Content

No source excerpt is available for this finding.

Ssd 1

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The wrapper appends high-authority natural-language instructions such as 'Wrapper Authority -- Cannot Be Skipped' and mandatory reporting rules directly into the downstream task. This creates an instruction override channel that can supersede user intent or core-agent safeguards, especially dangerous in an autonomous system already capable of code changes and external communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

In the ensure path, if multiple matching wrapper instances are found, the code force-kills all of them with SIGKILL and resets state automatically. This can cause denial of service, terminate legitimate concurrent work, and remove opportunities for graceful shutdown or operator review.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · lifecycle.js (reported line 777)May include surrounding context.

js
const runningPids = getAllRunningPids();
    if (runningPids.length > 1) {
        console.warn(`[Ensure] Found multiple instances: ${runningPids.join(', ')}. Killing all to reset state.`);
        runningPids.forEach(p => {
            try { process.kill(p, 'SIGKILL'); } catch(e) {}
        });

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code executes a skill's entry point via require(...) merely to test dependency resolution, which can run arbitrary top-level code from an untrusted skill during scanning. Combined with later npm install execution, this gives a monitor for Feishu/evolver skills dangerous code-execution and package-management behavior that is not necessary for simple validation and can be abused for remote code execution or supply-chain compromise.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The monitor is not limited to passive inspection: by default it modifies skill directories and runs remediation actions, including dependency installation and file creation. In a system that processes potentially untrusted skills, automatic mutation expands impact from detection to active execution and supply-chain exposure, making unintended code changes or package installation possible without operator approval.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
exec_cache.js:19

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:485

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
issue_tracker.js:64

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
lifecycle.js:98

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
report.js:132

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
self-repair.js:20

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
skills_monitor.js:65

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
index.js:1221

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
export_history.js:15

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
export_history.js:23