T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:78- Finding
Feishu application secret exposed through command-line arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
feishu-quick-setup
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it says, but it handles long-lived Feishu app secrets in ways that could expose them locally.
Review before installing. Use this only on a trusted single-user machine or after tightening file permissions, because it creates a Feishu app and stores its app secret locally. After setup, verify Feishu permissions manually, avoid granting broad document/drive/calendar/contact scopes unless needed, and rotate the app secret if it may have appeared in command logs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
quick-setup.mjs:89- Finding
Sensitive registration state and persistent credentials written without restrictive file permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs execution of Node scripts that perform external Feishu registration and local credential persistence, but the manifest does not declare any tool scope or permissions boundary. This creates a transparency and policy-enforcement gap: an agent may invoke network-capable code and write secrets to local config without an explicit capability declaration or user-facing guardrails.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description says the skill creates a Feishu app but does not prominently warn that newly issued app credentials will be saved to a local OpenClaw config file. This weakens informed consent around secret handling and local persistence, increasing the risk that users authorize storage of sensitive credentials without understanding where they will be written.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes an open-ended 'etc.', making activation criteria ambiguous and potentially broader than intended. In an agent setting, this can cause the skill to run on loosely related user requests, leading to unintended app creation, external authorization prompts, or credential writes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The message states that '基础权限（消息收发等）已默认开启', implying the created Feishu app has remote permissions enabled. However, this function only updates local openclaw.json fields and does not call any API to grant or enable Feishu app permissions. This is an active contradiction between the inline/user-facing documentation text and the code's actual behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The returned user-facing message is entirely in Chinese string literals, which forces a specific language for successful setup output. The file does not provide any user opt-in, locale selection, or justification that this skill is intended only for Chinese-speaking users.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The returned message states that '基础权限（消息收发等）已默认开启', implying the skill has enabled the bot's Feishu-side permissions. However, the implementation only creates the app via registration and writes credentials into openclaw.json; it does not call any API to grant or enable application permissions. This is an active contradiction between documentation/message text and actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This permission guide encourages enabling broad Feishu scopes across messages, documents, drive, calendar, tasks, wiki, and contacts, but it does not clearly explain the privacy, surveillance, and data-exposure consequences of granting those permissions. In the context of a one-click bot setup skill that creates a new app for users, omission of consent and least-privilege warnings can cause users to over-provision access without understanding that the bot may read sensitive enterprise content and personal data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The success message returned by saveFeishuConfig is entirely in Chinese, which forces a specific language for users regardless of their preferences. This is a natural-language policy concern because the file does not offer localization, fallback text, or any opt-in for that locale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all troubleshooting guidance exclusively in Chinese, with no indication that the skill or documentation is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content