ClawHub
Back to skill

Security audit

Create a Deep Research Feishu Doc

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Feishu research workflow, but it unnecessarily exposes Feishu tokens and possibly app secrets in normal output and error messages.

Review before installing. The core Feishu research and upload workflow is understandable, but do not run it as written unless token and secret output is removed or redacted, error diagnostics are sanitized, and the report watermark is made optional. Use a least-privileged Feishu app and rotate any credentials that may have appeared in transcripts or logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:93
Finding

Mandatory Third-Party Branding Alters User-Requested Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:134
Finding

Tenant Access Token Is Explicitly Disclosed in Agent Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:127
Finding

Failure Diagnostics Can Expose the Feishu Application Secret

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

确认：使用 exec + curl，绝不使用 feishu_doc/feishu_drive 工具

text

**Step 1: 获取 Tenant Access Token**

必须使用 curl 调用：
```bash

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly requires exposing a live tenant_access_token in user-visible output. Access tokens are bearer credentials; anyone who sees them may be able to invoke Feishu APIs with the skill's privileges until expiry, which is unrelated to the user-facing goal of delivering a report.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to report live Feishu access tokens back to the user creates direct credential disclosure without any legitimate requirement or warning. Because the token is sufficient to authenticate API requests, exposure can immediately enable misuse of cloud documents and drive resources.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill directs the agent to reveal sensitive authentication artifacts in progress messages, turning routine status reporting into a secret-exfiltration channel. In this context, the disclosure is more dangerous because the skill also fetches credentials from configuration, meaning real secrets could be automatically surfaced to any requester.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The example output demonstrates full credentials and document-related tokens in clear text, reinforcing an insecure pattern that operators or downstream models may imitate. Example blocks often become de facto implementation guidance, so this materially increases the chance of real secret leakage.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The example normalizes returning full live-like tokens and document identifiers, which encourages reproducible data leakage during normal operation. Since examples are likely to be copied verbatim, this creates a persistent pattern of exposing sensitive artifacts to end users and logs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

Step 1: 获取 Tenant Access Token

必须使用 curl 调用：

bash
curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H "Content-Type: application/json" \

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill mandates disclosing file_token, import ticket, doc_token, and full polling details, which exceeds operational necessity for report generation. These identifiers can expose internal object references, facilitate unauthorized follow-up actions, and normalize oversharing of sensitive workflow artifacts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.