ClawHub
Back to skill

Security audit

AIPing Media

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it combines automatic media generation with Feishu credential use, external message sending, broad URL fetching, and local temporary-file risks that should be reviewed before installation.

Install only if you expect media to be sent through Feishu and are comfortable storing Feishu app credentials for the agent. Use explicit recipient IDs, avoid passing arbitrary URLs as media sources, prefer local-only generation when possible, and treat generated files left in /tmp as potentially sensitive until removed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_feishu.py:41
Finding

Unrestricted Remote URL Fetching Enables SSRF and Resource Exhaustion

Content
View full analysis
bytes: """From CDN URL download file""" resp = requests.get(url, timeout=60) resp.raise_for_status() return resp.content ``` The function is invoked for caller-controlled HTTP and HTTPS sources: ```python if source.startswith("http://") or source.startswith("https://"): content = download_file(source) else: content = _read_local_file(source) ``` The equivalent video path is: ```python if source.startswith("http://") or source.startswith("https://"): content = download_file(source) else: content = _read_local_file(source) ``` From `scripts/generate_image.py`, a URL returned by the remote generation service is downloaded without destination or size validation: ```python if "data" in data and len(data["data"]) > 0: cdn_url = data["data"][0]["url"] result["url"] = cdn_url if download: # Automatically download locally try: local_path = download_image(cdn_url) result["local_path"] = local_path except Exception as e: result["download_error"] = str(e) ``` ```python def download_image(url: str) -> str: """Download image to local /tmp/ directory""" resp = requests.get(url, timeout=60, headers={ "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" }) resp.raise_for_status() ``` From `scripts/generate_video.py`, remote content is streamed to disk without a maximum byte count: ```python def download_video(url: str) -> str: """Download ...[truncated 3901 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:85
Finding

Predictable Non-Atomic Temporary Files Permit Symlink Overwrite Attacks

Content
View full analysis
_.jpg`. 4. Before the Skill opens the path, the attacker creates it as a symbolic link to another file writable ...[truncated 1260 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (34)

Tainted flow: 'api_key' from os.environ.get (line 29, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_image.py (reported line 43)May include surrounding context.

python
if aspect_ratio:
        payload["aspect_ratio"] = aspect_ratio
    
    resp = requests.post(
        f"{API_BASE}/images/generations",
        headers={
            "Authorization": f"Bearer {api_key}",

Tainted flow: 'app_id' from os.environ.get (line 24, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_feishu.py (reported line 34)May include surrounding context.

python
def get_token() -> str:
    """获取 tenant access token"""
    app_id, app_secret = _get_feishu_creds()
    resp = requests.post(
        f"{API_BASE}/auth/v3/tenant_access_token/internal",
        json={"app_id": app_id, "app_secret": app_secret}
    )

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch is more security-relevant because the skill advertises media generation but materially includes Feishu credential use and external message-sending behavior that are not explicitly surfaced in permissions metadata. Hidden or under-declared outbound communication capabilities can cause users to invoke the skill expecting local generation while it transmits content and identifiers to third parties.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch is more security-relevant because the skill advertises media generation but materially includes Feishu credential use and external message-sending behavior that are not explicitly surfaced in permissions metadata. Hidden or under-declared outbound communication capabilities can cause users to invoke the skill expecting local generation while it transmits content and identifiers to third parties.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch is more security-relevant because the skill advertises media generation but materially includes Feishu credential use and external message-sending behavior that are not explicitly surfaced in permissions metadata. Hidden or under-declared outbound communication capabilities can cause users to invoke the skill expecting local generation while it transmits content and identifiers to third parties.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
")

# 按手机号查 open_id（换成你的手机号，含国家码如 +8613800138000）
curl -s "https://open.feishu.cn/open-apis/contact/v3/users/batch_get_id?user_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mobiles": ["你的手机号"]}' | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

| 发送时 msg_type | image | media | | content 格式 | {"image_key": "xxx"} | {"file_key": "xxx", "type": "video"} |

完整 curl 示例（图片）

bash
# 1. 获取 token

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

| 发送时 msg_type | image | media | | content 格式 | {"image_key": "xxx"} | {"file_key": "xxx", "type": "video"} |

完整 curl 示例(图片)

bash
# 1. 获取 token

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
-d '{"app_id": "cli_xxx", "app_secret": "xxx"}' | python3 -c "import sys,json;print(json.load(sys.stdin)['tenant_access_token'])")

# 2. 上传图片
IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \
  -H "Authorization: Bearer $TOKEN" \
  -F "image_type=message" \
  -F "image=@/tmp/image.jpg" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['image_key'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
-F "image=@/tmp/image.jpg" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['image_key'])")

# 3. 发送图片
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\": \"oc_xxx\", \"msg_type\": \"image\", \"content\": \"{\\"image_key\\": \\"$IMAGE_KEY\\"}\"}"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md
-d '{"app_id": "cli_xxx", "app_secret": "xxx"}' | python3 -c "import sys,json;print(json.load(sys.stdin)['tenant_access_token'])")

# 2. 上传视频（注意：file_type 必须是 "mp4"，不是 "video/mp4"！）
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=mp4" \
  -F "file_name=video.mp4" \

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_feishu.py (reported line 32)May include surrounding context.

python
def get_token() -> str:
    """获取 tenant access token"""
    app_id, app_secret = _get_feishu_creds()
    resp = requests.post(
        f"{API_BASE}/auth/v3/tenant_access_token/internal",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_feishu.py (reported line 88)May include surrounding context.

python
def get_token() -> str:
    """获取 tenant access token"""
    app_id, app_secret = _get_feishu_creds()
    resp = requests.post(
        f"{API_BASE}/auth/v3/tenant_access_token/internal",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_feishu.py (reported line 113)May include surrounding context.

python
def get_token() -> str:
    """获取 tenant access token"""
    app_id, app_secret = _get_feishu_creds()
    resp = requests.post(
        f"{API_BASE}/auth/v3/tenant_access_token/internal",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares required environment variables and clearly documents outbound Feishu/API network use, but it does not declare any explicit tool scope or permissions. In an agent platform, undeclared access to env and network reduces transparency and weakens policy enforcement, making accidental credential exposure or unauthorized outbound actions more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The auto-trigger phrases are broad and overlap with ordinary user requests about image/video creation, which can cause the skill to run unexpectedly. In this context, unexpected execution is more dangerous because the skill can access credentials, write files locally, and send media externally to Feishu.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says the skill will automatically download generated media locally and send it to Feishu, but it does not present this as an explicit user-facing warning or consent boundary. Automatic persistence plus third-party transmission can surprise users and lead to unintended disclosure of sensitive prompts, images, or videos.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
with open('$(echo ~/.openclaw/openclaw.json)') as f:
    cfg = json.load(f)
env = cfg['env']
r = requests.post('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
    json={'app_id': env['FEISHU_APP_ID'], 'app_secret': env['FEISHU_APP_SECRET']})
print(r.json()['tenant_access_token'])
")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
with open('$(echo ~/.openclaw/openclaw.json)') as f:
    cfg = json.load(f)
env = cfg['env']
r = requests.post('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
    json={'app_id': env['FEISHU_APP_ID'], 'app_secret': env['FEISHU_APP_SECRET']})
print(r.json()['tenant_access_token'])
")

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example transmits a user's phone number to Feishu to resolve an open_id, which is an external transfer of personal data. In context, the danger is privacy leakage and over-collection rather than code execution, but it still warrants disclosure and minimization controls.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
")

# 按手机号查 open_id（换成你的手机号，含国家码如 +8613800138000）
curl -s "https://open.feishu.cn/open-apis/contact/v3/users/batch_get_id?user_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mobiles": ["你的手机号"]}' | python3 -m json.tool

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

| 发送时 msg_type | image | media | | content 格式 | {"image_key": "xxx"} | {"file_key": "xxx", "type": "video"} |

完整 curl 示例（图片）

bash
# 1. 获取 token

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This documented call sends image content and recipient identifiers to Feishu. Because the skill auto-downloads/generated media and prefers external message delivery, accidental or unauthorized transmission of sensitive content is a realistic risk if invocation is triggered unexpectedly or without explicit consent.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
-F "image=@/tmp/image.jpg" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['image_key'])")

# 3. 发送图片
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\": \"oc_xxx\", \"msg_type\": \"image\", \"content\": \"{\\"image_key\\": \\"$IMAGE_KEY\\"}\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This example transmits video content to Feishu, which can leak larger and potentially more sensitive media than simple text. In the context of broad auto-triggering and under-declared permissions, outbound media transmission raises meaningful confidentiality and compliance concerns.

Content

Scanner excerpt · SKILL.md (reported line 289)May include surrounding context.

md
-F "file=@/tmp/video.mp4" | python3 -c "import sys,json;print(json.load(sys.stdin)['data']['file_key'])")

# 3. 发送视频（msg_type 是 "media"，content 里 type 是 "video"）
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\": \"oc_xxx\", \"msg_type\": \"media\", \"content\": \"{\\"file_key\\": \\"$FILE_KEY\\", \\"type\\": \\"video\\"}\"}"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language strings exclusively in Chinese, including the module docstring and later CLI usage/error messages, without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 43)May include surrounding context.

python
if aspect_ratio:
        payload["aspect_ratio"] = aspect_ratio
    
    resp = requests.post(
        f"{API_BASE}/images/generations",
        headers={
            "Authorization": f"Bearer {api_key}",

Static analysis

No suspicious patterns detected.