Feishu Multi-Bot 飞书多机器人配置

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:07 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Feishu bot setup helper, but it applies persistent open-access chat settings and handles bot secrets without enough guardrails.

Review carefully before installing. Only use this if you intentionally want no-pairing Feishu access, understand that reachable users or groups may be able to talk to the connected agents, and are prepared to protect App Secrets and restrict the underlying agents' tools. Prefer allowlists or pairing, confirm the exact patch before applying it, and keep rollback instructions available.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:32

Finding

Open Direct-Message and Group Policies Bypass Bot Access Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-55
Vulnerability Type: Access-control bypass caused by insecure default configuration
Risk Level: High

The skill explicitly configures both direct-message and group access policies as open:

json

{
  "channels": {
    "feishu": {
      "enabled": true,
      "defaultAccount": "<first_agent_name>",
      "dmPolicy": "open",
      "connectionMode": "websocket",
      "domain": "feishu",
      "groupPolicy": "open",
      "accounts": {
        "<agent1>": {
          "appId": "<app_id_1>",
          "appSecret": "<app_secret_1>"
        },
        "<agent2>": {
          "appId": "<app_id_2>",
          "appSecret": "<app_secret_2>"
        }
      }
    }
  }
}

Technical Analysis

Setting dmPolicy to open deliberately disables pairing or equivalent admission controls for direct conversations. Setting groupPolicy to open similarly allows the bot to operate in groups without an explicit group allowlist.

These settings remove the trust boundary that should restrict who can submit instructions to an OpenClaw agent. Any Feishu user able to discover, add, message, or place the bot in a group may be able to interact with the associated agent. Because the configuration is applied through gateway config.patch, the exposure persists in the gateway configuration and affects every configured account using these policies.

The package does not define compensating controls such as user allowlists, group allowlists, role validation, per-account authorization, command restrictions, or confirmation requirements for sensitive operations. The actual consequences depend on the tools and permissions available to each OpenClaw agent, but the configuration exposes those capabilities to untrusted chat participants.

Attack Path

1. An operator follows the skill and applies the g ...[truncated 1402 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace dmPolicy: "open" with a pairing, approval, or explicit user-allowlist policy.
2. Replace groupPolicy: "open" with an explicit group allowlist or disable group interaction unless it is required.
3. Require the operator to supply approved Feishu user and group identifiers before applying the configuration.
4. Configure authorization independently for each bot account rather than relying on a single channel-wide open policy.
5. Apply least privilege to each underlying agent and disable sensitive tools for publicly reachable messaging agents.
6. Require explicit confirmation or secondary authorization before executing high-impact operations.
7. Add rate limiting, audit logging, abuse monitoring, and alerts for unknown users, unexpected groups, and repeated failed authorization attempts.
8. Validate the proposed patch and display a prominent warning before applying any configuration that enables unrestricted access.
9. After deployment, test both authorized and unauthorized accounts to confirm that unapproved users and groups are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to collect Feishu App Secret values in the chat workflow and then embed them into configuration, but it does not clearly warn the user that these are highly sensitive credentials that should be handled through a secure secret-management path. In an agent setting, this increases the chance that secrets are pasted into conversation history, logs, tool notes, or summaries, leading to credential exposure and downstream compromise of the associated Feishu bots.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to apply a configuration patch that changes live system settings and triggers an automatic Gateway restart, but it does not require a clear user-facing confirmation or warning about the operational impact. This can cause unintended service disruption, misconfiguration, or security posture changes—especially since the provided example also enables open DM access—without the user fully understanding the effect.

Content

No source excerpt is available for this finding.