Create a Deep Research Feishu Doc

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:14 PM UTC
• Version: 2.0.0

Overview

This is a coherent Feishu research workflow, but it unnecessarily exposes Feishu tokens and possibly app secrets in normal output and error messages.

Review before installing. The core Feishu research and upload workflow is understandable, but do not run it as written unless token and secret output is removed or redacted, error diagnostics are sanitized, and the report watermark is made optional. Use a least-privileged Feishu app and rotate any credentials that may have appeared in transcripts or logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:93
• Finding: Mandatory Third-Party Branding Alters User-Requested Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:93-98` and `SKILL.md:511-516` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Complete Code Snippet ```markdown #### 1.4 报告生成 - 整合所有数据 - **必须包含数据时效声明** - 添加虾哥 AI Research 水印 - 记录所有数据来源URL ``` The requirement is repeated in the final checklist: ```markdown 6. ⚠️ **必须包含**：数据时效声明 7. ✅ 保留 `虾哥 AI Research` 水印 8. ✅ 记录所有数据来源URL 9. ✅ 默认数据覆盖至 current_date（用户可覆盖） 10. ✅ 默认搜索速率 1次/秒（用户可覆盖） ``` ### Technical Analysis The Skill requires every generated report to include the third-party “Xia Ge AI Research” watermark, regardless of whether the user requested that attribution. The requirement is presented as mandatory and reinforced by the compliance checklist. This modifies the output objective of the current Agent session by adding promotional or attribution content unrelated to the core research and Feishu-upload operation. Because the instruction is automatically applied whenever the Skill is used, users may unknowingly publish documents carrying a third party's branding. There is no parameter for disabling the watermark and no requirement to obtain the user's informed consent before adding it. ### Attack Path 1. A user invokes the Skill to generate a research report. 2. The Skill loads its mandatory report-generation instructions. 3. The Agent generates the requested research content. 4. The mandatory watermark instruction causes the Agent to insert third-party branding. 5. The altered report is uploaded and imported into the user's Feishu workspace. 6. The branded document may subsequently be distributed as though the user intentionally approved the attribution. ### Impact Assessment The issue affects the integrity and provenance of all reports produced by the Skill. It does not directly grant system privileges or expose credentials, but it can: - Misrepresent the author or sponsoring organization of a report. - Introduce unrequested promotional content into ...[truncated 197 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory watermark requirement from the report-generation workflow and compliance checklist. 2. Make attribution explicitly opt-in through a parameter such as `--branding`. 3. Show the exact attribution text during the initial confirmation phase if branding is requested. 4. Default to an unbranded report unless the user provides informed approval. 5. Ensure that branding has no effect on whether the workflow is considered successful. 6. Add a compliance test verifying that reports remain unbranded when branding has not been requested. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:134
• Finding: Tenant Access Token Is Explicitly Disclosed in Agent Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:134-136`, with the requirement reinforced at `SKILL.md:493-497` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Complete Code Snippet ```markdown **✅ 检查点**：成功获取 token 后必须报告： - `tenant_access_token: t-xxxxx` ``` The compliance checklist makes disclosure mandatory: ```markdown - [ ] 是否使用了 `feishu_doc` 或 `feishu_drive` 工具？（必须：否） - [ ] 是否使用 `exec + curl` 调用 API？（必须：是） - [ ] 是否明确报告了 `tenant_access_token`？（必须：是） - [ ] 是否明确报告了 `file_token`？（必须：是） - [ ] 是否明确报告了 `ticket`？（必须：是） ``` The example also demonstrates a complete token-like value: ```markdown ✅ tenant_access_token: t-g1042792VRYNWEDIA5OIMF6HM4ERFV26GBJD2WEZ ``` ### Technical Analysis The Skill explicitly requires the complete Feishu tenant access token to be printed in Agent output. A tenant access token is a bearer credential: possession of a valid token is generally sufficient to authenticate API requests within the permissions granted to the associated application. Agent responses may be retained in conversation history, service telemetry, debugging logs, browser state, exported transcripts, or support records. Printing the token therefore expands its exposure from transient process memory to multiple persistent systems. The example containing a realistic token-like value also normalizes unsafe credential disclosure and may be copied into implementations or documentation. The workflow provides no masking, output-channel restriction, or log-sanitization requirement. ### Attack Path 1. The Skill reads the Feishu application configuration. 2. It submits the application ID and secret to the Feishu authentication endpoint. 3. Feishu returns a tenant access token. 4. The Skill requires the Agent to print the complete token in the conversation. 5. The conversation or associated telemetry is stored or viewed by another party. 6. That party extracts the bearer token. 7. Before expiration, the party submi ...[truncated 796 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never include a complete tenant access token in Agent output, logs, reports, or compliance evidence. 2. Replace the checkpoint with a non-sensitive status message such as `Tenant authentication succeeded`. 3. If correlation is necessary, display only a short masked fingerprint, such as `t-****7F26`, that cannot be used for authentication. 4. Keep tokens only in process memory and pass them directly to the required HTTP request. 5. Mark authorization headers and authentication responses as sensitive so that execution tooling redacts them automatically. 6. Remove the realistic token-like value from the example. 7. Sanitize existing transcripts and documentation that may contain valid credentials. 8. Revoke any token or application credential suspected of having been exposed. 9. Add automated tests that reject output containing complete bearer-token patterns. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:127
• Finding: Failure Diagnostics Can Expose the Feishu Application Secret<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:127-133` and `SKILL.md:357-363` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Complete Code Snippet The authentication command places the application secret directly in the command body: ```bash curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{ "app_id": "cli_xxx", "app_secret": "xxx" }' ``` The upload error-handling instructions require the command and returned error to be displayed: ```markdown ### 上传阶段错误 - **API 调用失败** - 显示 curl 命令和返回的错误信息 - 分析错误原因（token失效、权限不足、参数错误等） - **禁止**切换到 feishu_doc 工具作为备选 - 根据错误类型重试或终止 ``` ### Technical Analysis The Skill directs the Agent to construct a literal `curl` command containing the Feishu application secret. Separately, its error-handling policy requires displaying the curl command when an API call fails. No exception or redaction policy is provided for authentication requests, request bodies, or authorization headers. If the authentication operation fails and the generic diagnostic policy is applied, the complete command can be reproduced in Agent output with the long-lived application secret included. Other API commands can similarly expose bearer tokens through their `Authorization` headers. Unlike a short-lived tenant token, the application secret may remain valid until manually rotated. An attacker possessing both the application ID and secret can request fresh tenant access tokens repeatedly. ### Attack Path 1. The Skill retrieves `appId` and `appSecret` from OpenClaw configuration or asks the user to provide them. 2. It interpolates those values into the authentication curl command. 3. An authentication or related API failure occurs because of a transient error, invalid parameter, permission issue, or deliberate failure condition. 4. The generic error-handling rule instructs the Agent to display the cu ...[truncated 1152 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the instruction to display complete curl commands with a requirement to display only sanitized diagnostics. 2. Redact all values associated with: - `app_secret` - `tenant_access_token` - `Authorization` - Cookies, signatures, and other authentication material 3. Report only the HTTP method, endpoint path, status code, Feishu error code, and a sanitized error message. 4. Supply secrets to curl through protected environment variables, standard input, or a secure secret provider rather than embedding them in a printable command. 5. Disable shell tracing such as `set -x` while handling credentials. 6. Ensure command execution tooling applies redaction before storing stdout, stderr, command histories, or telemetry. 7. Use separate sanitized command templates for troubleshooting instead of echoing the command that was actually executed. 8. Rotate the Feishu application secret immediately if it has appeared in any transcript or execution log. 9. Add tests that simulate API failures and verify that neither application secrets nor bearer tokens appear in resulting output. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

确认：使用 exec + curl，绝不使用 feishu_doc/feishu_drive 工具
```

**Step 1: 获取 Tenant Access Token**

必须使用 curl 调用：
```bash

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly requires exposing a live `tenant_access_token` in user-visible output. Access tokens are bearer credentials; anyone who sees them may be able to invoke Feishu APIs with the skill's privileges until expiry, which is unrelated to the user-facing goal of delivering a report.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The instruction to report live Feishu access tokens back to the user creates direct credential disclosure without any legitimate requirement or warning. Because the token is sufficient to authenticate API requests, exposure can immediately enable misuse of cloud documents and drive resources.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill directs the agent to reveal sensitive authentication artifacts in progress messages, turning routine status reporting into a secret-exfiltration channel. In this context, the disclosure is more dangerous because the skill also fetches credentials from configuration, meaning real secrets could be automatically surfaced to any requester.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The example output demonstrates full credentials and document-related tokens in clear text, reinforcing an insecure pattern that operators or downstream models may imitate. Example blocks often become de facto implementation guidance, so this materially increases the chance of real secret leakage.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The example normalizes returning full live-like tokens and document identifiers, which encourages reproducible data leakage during normal operation. Since examples are likely to be copied verbatim, this creates a persistent pattern of exposing sensitive artifacts to end users and logs.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Step 1: 获取 Tenant Access Token**

必须使用 curl 调用：
```bash
curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill mandates disclosing `file_token`, import `ticket`, `doc_token`, and full polling details, which exceeds operational necessity for report generation. These identifiers can expose internal object references, facilitate unauthorized follow-up actions, and normalize oversharing of sensitive workflow artifacts.

Static analysis

No suspicious patterns detected.