OpenClaw Feishu Quota Guard

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 0.2.0

Overview

The skill mostly matches its stated purpose, but its diagnostic scanner can read broad personal folders and print sensitive matching lines, so it should be reviewed before use.

Install only if you are comfortable with a local remediation tool that can edit OpenClaw heartbeat config. Run the fixer with --dry-run first, pass explicit --config and --workspace paths when possible, and avoid running the candidate scanner without an explicit workspace root. Treat its output as sensitive because it may print tokens or private log/config lines, and be aware the installer overwrites any existing installed copy of this skill.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/find_feishu_quota_candidates.py:11

Finding

Diagnostic output may disclose Feishu verification tokens and other sensitive values

Content

View full analysis

List[str]: hits: List[str] = [] for path in iter_files(root): if not looks_text_file(path): continue text = read_text(path) if not text: continue for lineno, line in enumerate(text.splitlines(), 1): if CONTENT_RE.search(line): hits.append("{}:{}:{}".format(path, lineno, line.strip())) if len(hits) >= 120: return hits return hits ``` The collected line is printed without redaction: ```python for root in roots: print("== Root: {} ==".format(root)) print() print_section("-- Candidate files --", candidate_files(root)) print_section("-- Config/code lines --", content_hits(root)) print_section("-- Repeated probe clues (logs only) --", log_hits(root)) ``` The automatic fixer has the same disclosure pattern: ```python official_hits = grep_hits(workspace, r"@openclaw/feishu|channels\.feishu|connectionMode") custom_hits = grep_hits(workspace, r"verificationToken|/health|healthCheck|webhook|gateway") if official_hits: print() print("Official/current Feishu clues:") for hit in official_hits[:8]: print(f" - {hit}") if custom_hits: print() print("Custom webhook/gateway clues:" ...[truncated 2153 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/find_feishu_quota_candidates.py:43

Finding

Standalone scanner recursively reads unnecessarily broad user directories by default

Content

View full analysis

List[Path]: roots: List[Path] = [] home = Path.home() cwd = Path.cwd() for candidate in [ cwd, home / ".openclaw", home / ".config" / "openclaw", home / "OpenClaw", home / "openclaw", home / "Documents", home / "Downloads", ]: add_root(roots, candidate) return roots ``` These roots are selected automatically when the user supplies no arguments: ```python if args.roots: for arg in args.roots: add_root(roots, Path(arg).expanduser()) else: roots = default_roots() ``` ### Technical Analysis Recursively reading all supported text files beneath `Documents` and `Downloads` exceeds the minimum access needed to diagnose an OpenClaw workspace. These directories commonly contain unrelated source code, exported configurations, logs, credentials, personal documents, and downloaded archives. The scanner then searches those files for broad terms such as `gateway`, `webhook`, `health`, `feishu`, and `lark`. Matching content can be printed to stdout. This behavior increases exposure because the default scan scope is not limited to detected OpenClaw configuration or workspace directories. The code does not bypass operating-system permissions. It accesses only content readable by the executing account, but it violates least-privilege principles by processing unrelated data without requiring an explicit broad-scan option. ### Attack Path 1. A user or Agent invokes `find_feishu_quota_candidates.py` without specifying a root. 2. The program automatically selects the current directory, OpenClaw direc ...[truncated 909 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is an operational remediation skill for OpenClaw to analyze and fix quota burn behavior in Feishu/Lark-related workflows. The actual supplied code chunk does not implement that remediation logic; it merely dispatches to an installation script. Based on the code shown, the primary purpose is installation/bootstrap, which is materially different from the declared end-user function. While this installer could be a supporting component of the skill package, the evaluation is against the supplied code chunk itself, and that chunk does not match the described runtime behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as an operational remediation tool for Feishu/Lark quota burn, with behavior centered on running a bundled fixer and optionally doing follow-up analysis. The actual code shown is only an installation utility. It detects a workspace, recursively searches parts of the home directory, removes any existing target skill directory, copies metadata/scripts/reference files, and prints instructions for manually running another script. Those filesystem installation actions are not reflected in the description, and the code's primary purpose differs materially from the declared purpose of diagnosing/fixing quota burn. Therefore this code chunk does not accurately represent the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose emphasizes an operational repair workflow: automatically run a bundled fixer first, then do manual follow-up when custom gateway/webhook code is present. The actual code only searches directories and files for relevant keywords and log clues, and prints results plus advice. Its primary behavior is discovery/investigation, not fixing. It also scans broad user directories by default, which is a materially different resource access pattern than the description implies. While the topic area matches Feishu/Lark heartbeat/webhook quota issues, the implementation does not carry out the claimed remediation step, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared purpose emphasizes running a bundled run-once fixer to diagnose or remediate Feishu/Lark quota burn. The actual supplied code chunk is only a thin wrapper that executes another script, specifically one named find_feishu_quota_candidates.py. From this chunk alone, the demonstrated behavior is launching a candidate-finding script, not directly performing a fix. That is a materially different primary purpose from the description, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 192)May include surrounding context.

macOS / Linux：

bash

mkdir -p /path/to/openclaw/workspace/skills
cp -R openclaw-feishu-quota-guard /path/to/openclaw/workspace/skills/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 192)May include surrounding context.

macOS / Linux:

bash

mkdir -p /path/to/openclaw/workspace/skills
cp -R openclaw-feishu-quota-guard /path/to/openclaw/workspace/skills/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to run shell commands, read and modify configuration, and potentially inspect local files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authority gap where an agent may execute sensitive actions without transparent, least-privilege boundaries, increasing the chance of unintended filesystem or shell access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installer unconditionally removes the existing destination directory with shutil.rmtree() before copying the new skill files, with no confirmation, backup, or validation that the destination is safe to delete. If the target path is misdetected, mistyped, or replaced with a symlink or unexpected directory, this can destroy existing skill data or local modifications and cause denial of service or data loss.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/apply_feishu_quota_fix.py (reported line 16)May include surrounding context.

python

def run(cmd: Sequence[str]) -> str:
    try:
        out = subprocess.run(
            cmd,
            check=True,
            stdout=subprocess.PIPE,

Tainted flow: 'path' from os.environ.get (line 35, credential/environment) → shutil.copy2 (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/apply_feishu_quota_fix.py (reported line 96)May include surrounding context.

python

def backup_file(path: Path) -> Path:
    ts = datetime.now().strftime("%Y%m%d-%H%M%S")
    backup = Path(f"{path}.bak.feishu-quota-guard.{ts}")
    shutil.copy2(path, backup)
    return backup

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/apply_feishu_quota_fix.py (reported line 135)May include surrounding context.

python

if not workspace or not workspace.is_dir():
        return []
    if shutil.which("rg"):
        out = subprocess.run(
            [
                "rg",
                "-n",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script defaults to scanning broad personal directories such as ~/Documents and ~/Downloads, which exceeds the stated need of diagnosing OpenClaw/Feishu quota issues. In the skill context, this creates unnecessary access to unrelated user files and can expose sensitive filenames and content matches during normal operation, even if the author likely intended convenience rather than data collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently scans broad user directories and reads file contents without an in-tool warning that unrelated personal data may be accessed. In this skill context, users may expect a targeted Feishu/OpenClaw diagnostic, so the lack of disclosure makes the overbroad collection more dangerous and reduces informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The content and log scanning functions read arbitrary text and .log files throughout the selected roots, then print matching lines verbatim. That gives the skill a broad content-discovery capability beyond Feishu quota diagnosis and may reveal secrets, tokens, internal URLs, or private log data if those values appear on matching lines.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.