飞书周报

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 1.0.1

Overview

This weekly-report skill is coherent, but needs Review because it reads Feishu app secrets and private chat history with weak consent and secret-handling controls.

Install only if you intend the agent to access Feishu app credentials, Feishu chat contents, and workspace memory logs. Confirm the chat IDs and date range before each run, restrict the Feishu app to minimum message-read scopes, avoid printing or passing app_secret on the command line, and review or delete memory files that may retain sensitive work details.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_feishu_messages.sh:9

Finding

Feishu application secret exposed through Agent output and process arguments

Content

View full analysis

/scripts/fetch_feishu_messages.sh $START_TS $END_TS ``` ``` ```bash # scripts/fetch_feishu_messages.sh:9-16 APP_ID="${1:?Usage: $0 }" APP_SECRET="${2:?}" CHAT_ID="${3:?}" START_TS="${4:?}" END_TS="${5:?}" TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"${APP_ID}\",\"app_secret\":\"${APP_SECRET}\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") ``` ### Technical Analysis The Skill instructs the Agent to use `grep` without suppressing output to extract `appId` and `appSecret`. This can place the secret in the Agent transcript, tool output, execution logs, or other retained telemetry. The secret is then supplied as a positional command-line argument to the shell script. On systems where process metadata is visible to other users or monitoring software, the script's command line can be read from process inspection interfaces such as `/proc/

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_feishu_messages.sh:22

Finding

Unvalidated identifiers and pagination tokens are concatenated into authenticated Feishu API URLs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

代码行为与声明存在明显范围不一致。声明描述的是一个完整的“周报生成”技能，包含两种数据采集方式、本地日志读取、数据合并以及按模板输出周报。当前提供的代码片段只是一段 shell 脚本：使用 app_id/app_secret 获取飞书 tenant access token，随后分页拉取指定 chat_id 和时间范围内的消息，并输出标准化消息 JSON。虽然这与声明中的“方式(1) 调用飞书API拉取聊天记录”一致，但缺少声明中其余核心能力，因此若将该代码片段视为该技能的实现，则描述高于实际行为，构成不匹配。未发现额外的可疑越权能力；问题主要是声明的主要功能远超此代码实际实现范围。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to extract Feishu app credentials from a local OpenClaw config file via shell, exposing secrets unrelated to normal report formatting. Pulling credentials from disk materially increases risk of secret disclosure, misuse of the Feishu app, and unauthorized access to broader chat data if those credentials are reused or exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill reads local credentials and pulls chat history without a clear user-facing privacy disclosure or informed consent step. Because the accessed data includes secrets and private messages, lack of warning materially raises the risk of silent overcollection and unintended exposure of sensitive organizational information.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/fetch_feishu_messages.sh (reported line 15)May include surrounding context.

sh

START_TS="${4:?}"
END_TS="${5:?}"

TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"${APP_ID}\",\"app_secret\":\"${APP_SECRET}\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/fetch_feishu_messages.sh (reported line 29)May include surrounding context.

sh

URL="https://open.feishu.cn/open-apis/im/v1/messages?container_id_type=chat&container_id=${CHAT_ID}&start_time=${START_TS}&end_time=${END_TS}&sort_type=ByCreateTimeAsc&page_size=50"
  [ -n "$PAGE_TOKEN" ] && URL="${URL}&page_token=${PAGE_TOKEN}"

  RESP=$(curl -s "$URL" -H "Authorization: Bearer $TOKEN")
  CODE=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('code','-1'))" 2>/dev/null || echo "-1")
  [ "$CODE" != "0" ] && { echo "ERROR: API code $CODE" >&2; exit 1; }

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes shell commands to read local configuration, enumerate files, and run scripts, but it declares no tool scope or permission boundaries. This increases the chance an agent will execute sensitive local actions without explicit review or least-privilege constraints.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill explicitly tells the agent to collect conversation records and local memory notes, combine them, and produce a report from that material. This is a natural-language data exposure pattern because it operationalizes gathering and re-presenting potentially sensitive user communications and stored notes, even though it does not use explicit exfiltration terminology.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Broad trigger phrases like '工作总结' or '本周总结' can cause the skill to activate on common summarization requests where users may not expect chat-history retrieval or local file access. In this context, overbroad activation is dangerous because the skill performs sensitive data collection rather than a purely in-memory transformation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill expands from summarization into persistent writing of daily memory logs, which changes local state and stores potentially sensitive work content for future reuse. That broadens data retention and creates privacy and integrity risks if users did not explicitly authorize ongoing storage of conversation-derived content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The optional memory-writing behavior modifies local files and persists work summaries, but the documentation does not present a strong warning about filesystem changes and long-term retention. Users may reasonably expect a reporting skill to summarize data, not create durable records that could later be read, leaked, or become stale and misleading.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Persisting substantive conversation content into local memory logs creates a secondary store of potentially sensitive data beyond the immediate report-generation task. That increases long-term exposure, makes later unintended reuse more likely, and can capture private or inaccurate content without users realizing it is being archived.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_feishu_messages.sh (reported line 15)May include surrounding context.

sh

START_TS="${4:?}"
END_TS="${5:?}"

TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"${APP_ID}\",\"app_secret\":\"${APP_SECRET}\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")