Wcs Helper Feishu Skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 1.0.1

Overview

This skill mostly matches its stated Feishu admin-helper purpose, but it needs Review because chat commands can change OpenClaw settings or restart the service without an in-skill authorization check, and it caches a Feishu bearer token in a shared temp file.

Install only if the Feishu route is limited to trusted operators and you are comfortable letting chat commands change OpenClaw Feishu settings and restart the gateway. Before production use, add an explicit admin allowlist, private-chat enforcement, confirmation/rate limits for restart and broad group-reply changes, and replace the shared /tmp token cache with private in-memory or owner-only storage.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: feishu_handler.py:48

Finding

Administrative Commands Execute Without Explicit Authorization

Content

View full analysis

' ''", file=sys.stderr) sys.exit(1) result = handle(sys.argv[1]) if result is None: sys.exit(0) msg_type, content = result if msg_type == "card": ok = send_card(sys.argv[2], json.dumps(content)) print("Card sent successfully" if ok else "Card delivery failed") else: print(content) ``` The dispatched command reaches the following privileged operations: ```python def cmd_toggle(): cur = get_streaming(); new_val = not cur if cur in (True,False) else True subprocess.run(["openclaw","config","set","channels.feishu.streaming",str(new_val).lower()], capture_output=True, timeout=5) return make_card("📡 Typing Effect", [ md(f"**{'✅ Enabled' if new_val else '❌ Disabled'}**"), hr(), md(f"Typing effect has been {'enabled' if new_val else 'disabled'}"), ]) def cmd_set_mention(mode): val = "true" if mode.upper()=="A" else "false" subprocess.run(["openclaw","config","set","channels.feishu.requireMention",val], capture_output=True, timeout=5) label = "✅ Rep ...[truncated 3193 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: feishu_handler.py:7

Finding

Feishu Tenant Bearer Token Is Cached in an Unsafe Shared Temporary File

Content

View full analysis

__import__("time").time() + 60: return data["token"] except: pass cfg = json.loads(open(os.path.expanduser("~/.openclaw/openclaw.json")).read()) feishu = cfg.get("channels", {}).get("feishu", {}) app_id = feishu.get("appId", ""); app_secret = feishu.get("appSecret", "") req = urllib.request.Request( "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(), headers={"Content-Type": "application/json"}) with urllib.request.urlopen(req, timeout=10) as r: result = json.loads(r.read()) token = result.get("tenant_access_token", "") TOKEN_FILE.write_text(json.dumps({"token": token, "expire": __import__("time").time() + 1900})) return token ``` ### Technical Analysis The tenant access token is written in plaintext to a globally predictable path under `/tmp`. The code does not: - Create the file with an explicit `0600` permission mode. - Use a user-private runtime directory. - Verify file ownership before trusting cached content. - Reject symbolic links. - Use exclusive or atomic file creation. - Remove the token after expiration. The resulting permissions depend on the process umask and existing filesystem state. In a multi-user environment, another local account may be able to observe the file, pre-create it, replace it, or introduce a symbolic link. The code also accepts th ...[truncated 1841 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/utils.py:11

Finding

Reusable Command Helper Falls Back to Arbitrary Shell Execution

Content

View full analysis

ExecResult: """ Execute a system command through OpenClaw ctx.exec. """ try: # Invoke OpenClaw's exec method. if hasattr(ctx, 'exec'): result = await ctx.exec(command) return ExecResult( code=result.get('code', 0), stdout=result.get('stdout', ''), stderr=result.get('stderr', ''), error=result.get('error') ) else: # Fallback implementation. import subprocess process = subprocess.run( command, shell=True, capture_output=True, text=True, timeout=30 ) return ExecResult( code=process.returncode, stdout=process.stdout, stderr=process.stderr ) except Exception as e: return ExecResult( code=1, stdout='', stderr=str(e), error=str(e) ) ``` ### Technical Analysis `exec_command()` accepts a free-form string and passes it to `subprocess.run(..., shell=True)` when `ctx.exec` is unavailable. Shell metacharacters, command substitutions, pipelines, redirections, and additional commands are therefore interpreted by the operating-system shell. The alternative `ctx.exec(command)` path also forwards the same unrestricted command string to an external execution API whose parsing and security properties are not defined here. No production handler in the reviewed project currently calls `exec_command()` with user-controlled data. Therefore, a directly reachable command-injection exploit was not confirmed in the present command r ...[truncated 1501 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Installation Guidance Uses Mutable and Unpinned Remote Dependencies

Content

View full analysis

=2026.2.0 ``` `pyproject.toml`: ```toml dependencies = [ "openclaw>=2026.2.0", ] ``` `SKILL.md`: ```bash npx -y clawhub install guanqi0914/wcs-helper-feishu-skill ``` `QUICKSTART.md`: ```bash git clone https://github.com/guanqi/guanqi-feishu-config-skill.git cd guanqi-feishu-config-skill python -m venv venv source venv/bin/activate pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple ``` The same guide recommends persistent global package-index configuration: ```bash cd ~ mkdir -p .pip cat > .pip/pip.conf << EOF [global] index-url = https://pypi.tuna.tsinghua.edu.cn/simple trusted-host = pypi.tuna.tsinghua.edu.cn EOF ``` ### Technical Analysis The runtime dependency is constrained only by a minimum version. There is no exact version, upper bound, lock file, or artifact hash. A future release can therefore be selected and installed without being covered by this audit. The recommended `npx -y` installation flow permits automatic retrieval and execution of remote package tooling without interactive confirmation or a pinned installer version. The quickstart also directs users to an alternate Python package index and recommends changing the user's global pip configuration. Even when the alternate index is legitimate, this expands the supply-chain trust boundary and affects unrelated future package installations. No malicious dependency was demonstrated in the reviewed files. The vulnerability is the installation process's inability to reproduce the audited dependency set and its unnecessary expansion of trusted remote sources. ### Attack Path 1. A user follows the docume ...[truncated 1325 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared ability to execute arbitrary shell commands is a serious risk, particularly in a skill presented as a narrow Feishu configuration interface. If slash-command handling can trigger shell execution beyond a strict allowlist, an attacker could escalate from chat interaction to local command execution, service disruption, or data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Undeclared ability to execute arbitrary shell commands is a serious risk, particularly in a skill presented as a narrow Feishu configuration interface. If slash-command handling can trigger shell execution beyond a strict allowlist, an attacker could escalate from chat interaction to local command execution, service disruption, or data access.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared ability to execute arbitrary shell commands is a serious risk, particularly in a skill presented as a narrow Feishu configuration interface. If slash-command handling can trigger shell execution beyond a strict allowlist, an attacker could escalate from chat interaction to local command execution, service disruption, or data access.

Content

No source excerpt is available for this finding.

Tainted flow: 'req' from open (line 20, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · feishu_handler.py (reported line 24)May include surrounding context.

python

"https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(),
        headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req, timeout=10) as r:
        result = json.loads(r.read())
    token = result.get("tenant_access_token", "")
    TOKEN_FILE.write_text(json.dumps({"token": token, "expire": __import__("time").time() + 1900}))

Tainted flow: 'req' from open (line 20, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · feishu_handler.py (reported line 39)May include surrounding context.

python

headers={"Content-Type": "application/json", "Authorization": f"Bearer {get_token()}"},
        method="POST")
    try:
        with urllib.request.urlopen(req, timeout=15) as r:
            return json.loads(r.read()).get("code") == 0
    except urllib.error.HTTPError as e:
        print(f"HTTP {e.code}: {e.read().decode()[:100]}", file=sys.stderr)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This utility intentionally provides a generic command execution primitive through ctx.exec and, failing that, direct shell execution. For a skill advertised as toggling configuration, diagnostics, and restarts via Feishu, this creates an unnecessary remote administration backdoor surface where any flaw in caller-side validation can become full system command execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using shell=True with a variable command is a classic tool-parameter abuse pattern because metacharacters, chaining, redirection, and subshell syntax can change program behavior beyond intended inputs. In a messaging-controlled admin skill, this becomes especially dangerous because chat-originated data can eventually drive host-level command execution.

Content

Scanner excerpt · src/utils.py (reported line 31)May include surrounding context.

python

# 降级方案：返回模拟结果
            # 实际部署时应该使用真实的 ctx.exec
            import subprocess
            process = subprocess.run(
                command,
                shell=True,
                capture_output=True,

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · QUICKSTART.md (reported line 28)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update
sudo apt install python3.12 python3.12-venv python3-pip

# 验证

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · QUICKSTART.md (reported line 29)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update
sudo apt install python3.12 python3.12-venv python3-pip

# 验证

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install and execute a package via npx -y clawhub without pinning a specific version. This creates a supply-chain risk because future or compromised releases of clawhub could execute unexpected code during installation or runtime, and users following the documentation would implicitly trust whatever version is current at that time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises commands that modify OpenClaw configuration and restart the service, but provides no warning that these are system-impacting administrative actions. In the Feishu private-chat context, users may underestimate the sensitivity of these commands, increasing the chance of accidental misuse, unsafe deployment, or exposure of privileged controls through an insufficiently protected chat interface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly encourages extending the skill by adding new subprocess.run(...) branches for arbitrary commands. In a chat-triggered admin skill, this normalizes command execution patterns that can easily become unsafe if future commands incorporate user input, broaden privilege scope, or invoke sensitive system operations without validation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises administrative actions that imply file reads/writes, service control, diagnostics, and likely shell/network access, yet it declares no explicit tool scope or permissions. That mismatch weakens reviewability and least-privilege controls, making it easier for an overprivileged implementation to perform sensitive actions without clear disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An automatic fix feature that modifies processes or system state without an explicit warning or confirmation can cause unintended disruption, especially when invoked through chat. In this context, users may trigger cleanup or termination actions without understanding that processes, tunnels, or disk-related state will be changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A restart operation can interrupt service availability and affect active sessions, but the skill presents it as a simple chat command without a user warning. Because this skill is remotely invocable through Feishu, lack of interruption messaging and safeguards increases the risk of accidental denial of service.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Using npx -y clawhub without a pinned version creates a supply-chain risk because installation behavior can change over time or resolve to a compromised release. For an admin-oriented skill that can change config and restart services, this increases the blast radius of a malicious or broken package update.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · feishu_handler.py (reported line 14)May include surrounding context.

python

if TOKEN_FILE.exists():
        try:
            data = json.loads(TOKEN_FILE.read_text())
            if data.get("expire", 0) > __import__("time").time() + 60:
                return data["token"]
        except: pass
    cfg = json.loads(open(os.path.expanduser("~/.openclaw/openclaw.json")).read())

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The handler reads Feishu app credentials from the user's local OpenClaw config and exchanges them for an access token, giving this skill access to external messaging capabilities tied to the user's environment. In an agent-skill context, that is a meaningful privilege because it expands from simple command formatting into secret consumption and API impersonation without clear minimization or isolation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code consumes sensitive app credentials from a local config file and transmits them to Feishu for token issuance without any visible user disclosure or explicit consent in this component. In a skill ecosystem, silent secret use is dangerous because users may not expect a helper skill to access broader account credentials or externalize authentication material flows.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · feishu_handler.py (reported line 27)May include surrounding context.

python

with urllib.request.urlopen(req, timeout=10) as r:
        result = json.loads(r.read())
    token = result.get("tenant_access_token", "")
    TOKEN_FILE.write_text(json.dumps({"token": token, "expire": __import__("time").time() + 1900}))
    return token

def send_card(user_open_id, card_content):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This component sends generated content to Feishu over the network, which is core functionality, but there is no evident disclosure in code or manifest excerpt about what data leaves the local environment. In a command-helper skill, missing transparency can lead users to expose diagnostics or service details externally without realizing outputs are being transmitted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · feishu_handler.py (reported line 52)May include surrounding context.

python

text = text.strip()
    if not text.startswith("/"):
        return None
    r = subprocess.run(["python3", str(SKILL_DIR / "skill.py"), text],
        capture_output=True, text=True, timeout=20, cwd=str(SKILL_DIR))
    output = r.stdout.strip()
    if not output:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest description is written as a Chinese-language assistant for configuring the plugin, but it does not indicate whether language is user-selectable or whether the locale restriction is intentional and documented. Per policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill's natural-language interface, command labels, and responses are entirely in Chinese, including fixed trigger phrases such as /万重山-飞书-重启 and all help text. There is no indication that the language is optional, user-selectable, or justified as a region-specific constraint, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill.py (reported line 19)May include surrounding context.

python

def get_procs():
    try:
        r = subprocess.run(["pgrep","-f","openclaw","-c"], capture_output=True, text=True, timeout=3)
        return int(r.stdout.strip()) if r.stdout.strip().isdigit() else 0
    except: return 0