Security audit

Feishu Whiteboard Extract

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Feishu whiteboard extraction/export helper, but it includes an under-documented raw full-node export and sensitive credential-backed access that should be reviewed before use.

Review before installing. Use a dedicated least-privilege Feishu app, share only the specific whiteboards needed with that app, avoid running export_nodes_raw.js unless you intentionally want full board node data in stdout/logs, and regenerate dependencies from an HTTPS registry before deploying in a sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation describes executable scripts that use network access and likely read credentials from environment variables or local config, yet no permissions are declared. This creates a transparency and governance problem: operators may invoke a skill believing it is low-risk metadata extraction when it can actually access external APIs and local secrets, reducing the effectiveness of permission review and sandboxing.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose says the skill only extracts image-node file_token values, but the content documents substantially broader behavior: downloading media to local disk, exporting full-board images, potentially enumerating more board data, and using local or environment credentials to access Feishu APIs. This mismatch can mislead users and reviewers about the skill's true data access and exfiltration surface, increasing the chance of over-collection, unauthorized downloads, and unsafe handling of sensitive board contents.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The stated skill purpose is only to extract whiteboard image file_token values, but this code authenticates to Feishu, downloads the underlying media, and persists it locally. That is a material capability expansion from metadata extraction to content exfiltration/storage, which increases risk because users or reviewers may authorize the skill under a narrower expectation than what it actually does.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script reads Feishu app credentials from a local config file even though the advertised capability does not require local secret access for mere token extraction. This creates unnecessary secret exposure and privilege use, and in context suggests hidden behavior beyond the documented function of the skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The implementation materially deviates from the declared skill purpose. Instead of extracting image-node file_token values, it authenticates to Feishu and downloads the entire whiteboard render, which can capture all board contents including unrelated text, diagrams, and sensitive information. In a skill ecosystem, this is dangerous because callers may grant or invoke it expecting narrow metadata extraction, while it performs broad data exfiltration-capable retrieval.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code loads reusable Feishu app credentials from environment variables or ~/.openclaw/openclaw.json even though the stated task is narrow token extraction. Pulling secrets from ambient sources increases the blast radius: any invocation of this skill can silently gain authenticated access to Feishu APIs and act beyond the user’s likely expectations. In context, this becomes more concerning because the skill already performs broader-than-declared data access.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script enumerates and prints all whiteboard nodes in raw form, which exceeds the stated purpose of extracting image-node file_token values. This creates unnecessary data exposure because non-image nodes may contain sensitive board content, metadata, or collaboration artifacts that a caller did not intend to export.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The header comments explicitly state that the script exports all whiteboard nodes raw, which contradicts the advertised skill purpose of extracting image-node file_token values. This mismatch is dangerous because users and downstream tooling may trust the manifest while the code performs broader data export than expected.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Reading application credentials from ~/.openclaw/openclaw.json without clear disclosure is risky because it silently consumes local secrets the user may not expect this skill to access. In a skill whose declared purpose is narrower than the actual behavior, undisclosed secret access materially increases the chance of unauthorized data access or trust boundary violations.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The code downloads remote content and writes it to disk without explicit warning, which can surprise users and create unintended local data persistence. In this skill context, that matters more because the documented purpose is token extraction, not file creation, so the side effect is inconsistent with user expectations.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The code accesses sensitive Feishu credentials from environment variables and a home-directory config file without any user-facing notice at runtime. In a skill ecosystem, silent use of ambient credentials can surprise users and increase the chance of unintended access to protected tenant data.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script retrieves board data over the network and then exports the returned node contents to stdout without warning the user that full whiteboard content may be disclosed. Because the implementation outputs raw nodes rather than minimal tokens, this can leak sensitive board material into logs, pipelines, or calling agents unexpectedly.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The lockfile pins package tarballs to plain HTTP mirror URLs, which allows a network attacker or compromised mirror path to tamper with package downloads in transit. Although npm integrity hashes provide some protection, using insecure transport still weakens the supply-chain trust model, can leak metadata, and creates avoidable risk if clients, tooling, or workflows ever bypass or inconsistently enforce integrity verification.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: export_board_svg.js:31