Feishu Document Permission

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

This skill does what it says by making Feishu documents link-readable, but it ships a plaintext Feishu app secret and records full document tokens in a persistent log.

Do not install this version unless the Feishu app secret has been revoked and replaced with user-provided secure credentials. Users should also require explicit approval before public-link sharing and avoid logging full document tokens in workspace files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:46

Finding

Hardcoded Feishu Application Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-47
Vulnerability Type: Hardcoded application credentials
Risk Level: High

Affected code:

bash

APP_ID="cli_a9217db4a3f59cb6"
APP_SECRET="G34RRAc41XOY7vb2a7NmMgwl5chruBmo"

Technical Analysis

The skill embeds a Feishu application ID and application secret directly in a tracked project file. Anyone who can read the skill package, repository history, build artifacts, backups, logs containing the file, or installed skill directory can recover these credentials.

The subsequent instructions submit these credentials to Feishu's tenant-token API to obtain a tenant access token. Consequently, this is not merely an informational identifier exposure: the application secret can be used to authenticate as the configured Feishu application.

Because the credential has already been committed or distributed in plaintext, deleting it from the current version alone is insufficient. It must be considered compromised and rotated. Copies may remain in repository history, caches, archives, and deployed skill packages.

Attack Path

1. An attacker obtains read access to SKILL.md through the project repository, a distributed skill package, a backup, or a local installation.
2. The attacker extracts the exposed application ID and application secret.
3. The attacker submits the credentials to the documented Feishu tenant access-token endpoint.
4. If the credentials remain active, Feishu returns a tenant access token.
5. The attacker invokes Feishu APIs as the application, subject to its configured scopes and resource authorization.
6. In this skill's documented context, the attacker may inspect or change document-sharing permissions for resources accessible to the application.

Impact Assessment

Successful exploitation permits authentication as the affected Feishu application. The exact scope is determined by the application's Feishu permissions, ...[truncated 412 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed Feishu application secret.
2. Remove both credentials from the skill documentation and all distributed copies.
3. Load credentials at runtime from an approved secret manager or protected environment variables, for example:

   bash

   : "${FEISHU_APP_ID:?FEISHU_APP_ID is required}"
   : "${FEISHU_APP_SECRET:?FEISHU_APP_SECRET is required}"
   

4. Do not print secrets, tenant access tokens, or complete authentication responses to logs.
5. Purge the secret from version-control history and invalidate old archives where feasible. Rotation remains mandatory even after history rewriting.
6. Review Feishu application audit logs for suspicious token issuance and API activity since the credential was first exposed.
7. Restrict the application to the minimum Feishu scopes and document resources required for permission management.
8. Add secret scanning to pre-commit hooks and CI, and block commits containing credential patterns.
9. Prefer short-lived credentials or workload identity mechanisms where supported.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Document Tokens Written to a Persistent Plaintext Log

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 98
Vulnerability Type: Plaintext storage of sensitive document identifiers
Risk Level: Medium

Affected code:

bash

echo "$(date): 文档 ${DOC_TOKEN} 权限已设置为 anyone_readable" >> memory/feishu_permission_log.md

Technical Analysis

The skill instructs the agent to append every document token to a persistent Markdown file without defining restrictive file permissions, retention limits, redaction, encryption, or access controls.

A Feishu document token identifies the target resource and is used to construct document and permission API paths. The skill also changes the corresponding document to anyone_readable. In that state, disclosure of the token can enable anyone who can read the log to reconstruct the document URL and access its contents without individual authorization.

The log additionally creates a durable inventory of documents whose permissions were changed, including timestamps and sharing state. Relative-path logging may place the file in an unexpected workspace depending on the process's current working directory, increasing the chance of accidental inclusion in source control, artifacts, backups, or shared directories.

Attack Path

1. The skill changes a document to allow access by anyone possessing its link.
2. It appends the complete document token and timestamp to memory/feishu_permission_log.md.
3. A local user, workspace collaborator, backup reader, artifact consumer, or repository user obtains the log.
4. The reader extracts a document token and uses it to reconstruct the corresponding Feishu document URL.
5. Because the skill configured link-based public reading, the reader accesses the document without being explicitly added as a collaborator.

Impact Assessment

The issue can disclose documents intentionally made link-readable but not necessarily intended to be broadly discoverable. Exposure is limited to to ...[truncated 497 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not store complete document tokens unless they are strictly necessary for an approved audit requirement.
2. Prefer a non-reversible keyed hash or a minimally redacted token, such as the final four characters, for operational correlation.
3. Store structured audit records in a protected logging system rather than a Markdown file inside the workspace.
4. If local logging is unavoidable, use a fixed protected location, create files with restrictive permissions such as mode 0600, and verify ownership before writing.
5. Define and enforce a short retention period with automatic deletion.
6. Exclude permission logs from version control, build artifacts, support bundles, and shared backups.
7. Record only the result code, timestamp, actor, and redacted resource identifier; never record access tokens, application secrets, or full public links.
8. Review existing copies of memory/feishu_permission_log.md, restrict access, remove unnecessary records, and reassess the sharing permissions of documents whose tokens may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill’s primary behavior is to make documents readable by anyone with the link, but it does not prominently frame this as a potentially sensitive data exposure action requiring explicit user approval. In practice, this can cause confidential or internal documents to be shared externally with weak distribution control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill embeds a live Feishu APP_ID and APP_SECRET directly in documentation, which exposes reusable credentials to anyone who can read the skill. Hardcoded secrets enable unauthorized API access, token minting, and modification of document permissions well beyond the immediate task.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

APP_ID="cli_a9217db4a3f59cb6"
APP_SECRET="G34RRAc41XOY7vb2a7NmMgwl5chruBmo"

TENANT_TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{
    \"app_id\": \"$APP_ID\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

步骤 3：设置权限（如需要）

bash

curl -X PATCH "https://open.feishu.cn/open-apis/drive/v2/permissions/${DOC_TOKEN}/public?type=docx" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TENANT_TOKEN" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill instructs storing document tokens and sharing state in a local log without discussing retention, access controls, or sensitivity of that metadata. Those logs can become an inventory of externally shared documents and may aid further discovery or unauthorized access if the workspace is exposed.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

3. 建立机制 — 不能只靠"记住教训"，要固化到技能中

## 相关文件
- **技能位置：** `~/.openclaw/skills/feishu-document-permission/SKILL.md`
- **检查脚本：** `/home/harrot/.openclaw/workspace/scripts/check-feishu-permission.sh`
- **权限日志：** `/home/harrot/.openclaw/workspace/memory/feishu_permission_log.md`
- **错误记录：** `/home/harrot/.openclaw/workspace/.learnings/ERRORS.md`（2026-04-13 条目）

Static analysis

No suspicious patterns detected.