T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu-contacts.py:124- Finding
Organization-Wide Contact Data Is Cached Without Secure File Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Contacts
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims, but it syncs and stores an organization-wide Feishu directory locally without enough privacy, permission, or retention safeguards.
Install only if the Feishu app is authorized to read the relevant directory and the local machine can safely store employee contact data. Before use, restrict ~/.openclaw permissions, treat the cache as sensitive, periodically delete stale cache data, and avoid bulk department lookups unless they are necessary and approved.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:8- Finding
Third-Party Python Dependency Is Not Version or Hash Pinned
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill clearly instructs the agent to perform network access to Feishu APIs and write a persistent local cache file, yet it declares no explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause the agent runtime or reviewer to underestimate what the skill can do, including retrieving and storing employee directory data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that the skill fetches live employee details and persists a local cache containing users, departments, and mappings, but it provides no privacy warning, retention guidance, or handling restrictions for this personal data. In practice, this can lead to over-collection, unnecessary exposure of employee contact information, and unsafe downstream use of emails, phone numbers, and org data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Although described as a search skill, the code performs a full organizational directory crawl by enumerating all departments and users, then builds a complete local dataset. This creates a much larger data access footprint than a targeted lookup tool and increases the blast radius if the host is compromised or the skill is misused for bulk employee enumeration.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script persistently stores a complete directory cache under the user’s home directory, including user identifiers, names, emails, department membership, and related metadata. Persistent bulk storage of directory data creates a standing privacy and security risk, especially if file permissions are weak, backups are exposed, or other local processes can read the cache.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The sync workflow writes a local file containing organization contact data but only emits a generic success message, without clearly warning that employee directory information is being persisted on disk. Lack of transparency can cause users to trigger bulk local retention of sensitive data without informed consent, increasing accidental policy violations and privacy exposure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest frames the skill as a contact lookup utility for open_id, email, and department info, but the live
getcommand also retrieves and prints additional personal data such as union_id, enterprise_email, and mobile. This broadens data exposure beyond the declared scope, increasing privacy risk and making it easier for downstream users or agents to access unnecessary sensitive employee information.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Most operational instructions, command explanations, and mandatory workflow guidance are presented only in Chinese, with no indication that users can choose another language. SQP-3 applies to natural-language policy violations when a skill forces a specific language without user opt-in.
- Content