ClawHub
Back to skill

Security audit

Feishu Bitable Creator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Feishu/Lark Bitable helper that creates and populates new tables, with expected but sensitive permission setup for the created table.

Install only if you intend this agent to create Feishu Bitables using your configured Feishu app and to grant full admin access on created tables to a provided open_id. Confirm the owner ID before use, and make sure the Feishu app permissions are acceptable for your workspace.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: feishu-bitable-creator
description: |
  Create and populate Feishu (Lark) Bitable (multidimensional tables) with automated cleanup.
  Use when the user needs to:
  1. Create a new Bitable from scratch with clean structure (no placeholder rows/columns)
  2. Batch create fields and records in a Bitable

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown mixes some English headings with extensive Chinese instructions, examples, field names, and output text, effectively constraining usage to Chinese readers. The file does not offer an opt-in language choice or explain that the skill is intentionally region- or language-specific.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

The skill advertises automatic destructive and permission-changing actions: deleting placeholder rows/columns, renaming schema, and adding an owner as admin. In an agent setting, bundling these side effects into default behavior can cause unauthorized or unintended modifications if explicit user confirmation and identity validation are not enforced at runtime.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
- Creator has full control, but human owner has no permissions

**This skill solves these issues:**
- ✅ Automatically deletes empty placeholder rows and default columns
- ✅ Intelligently renames primary field based on table name
- ✅ Adds owner as admin with full permissions
- ✅ Provides clean slate for your actual data

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring says user_id is the user's open_id, but the function parameter is named user_id and the API payload sends it as member_id with member_type: 'openid'. This is an active contradiction in the inline documentation about what identifier format the caller must provide, which can mislead use of the permission-granting function.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.