ClawHub
Back to skill

Security audit

Feishu Skills Kit 飞书技能全集

Security checks for vulnerabilities and agentic risk

Overview

This is a real Feishu integration bundle, but it needs Review because it combines Feishu credentials, persistent bridge execution, broad local-agent access, and exploitable command-handling flaws.

Install only after reviewing the external MCP server repository at a pinned commit, replacing shell-string execution in the card scripts, using least-privilege Feishu app scopes, configuring explicit allowed Feishu senders/chats for the bridge, and deciding whether a persistent LaunchAgent is acceptable. Treat any configured Feishu App Secret and local gateway token as high-value credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (8)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:165
Finding

Unpinned Remote Repository Is Downloaded and Executed with Feishu Credentials

Content
View full analysis
/dev/null || mkdir -p ~/.openclaw/workspace/skills && cd ~/.openclaw/workspace/skills git clone https://github.com/Shuai-DaiDai/feishu-doc-manager.git cd feishu-doc-manager # Execute install.sh if it exists [ -f install.sh ] && bash install.sh ``` The resulting external script is then configured as an MCP process with Feishu credentials: ```json "feishu-doc-manager": { "command": "bash", "args": [ "/install.sh" ], "env": { "FEISHU_APP_ID": "", "FEISHU_APP_SECRET": "" }, "_comment": "Feishu document management MCP Server" } ``` ### Technical Analysis The installation procedure clones the current default branch of an external GitHub repository without selecting an immutable commit, release artifact, checksum, or cryptographic signature. It then immediately executes `install.sh`. The executed script is not included in this project, so its effective behavior can change after this project has been reviewed. In addition, the MCP template repeatedly executes that external script while exposing `FEISHU_APP_ID` and `FEISHU_APP_SECRET` through its environment. This creates a time-of-review versus time-of-use supply-chain boundary: the code ultimately executed by the user is not fixed by this repository. ### Attack Path 1. An attacker compromises the external repository, its maintainer account, or its default branch. 2. The attacker modifies `install.sh` or files loaded by that script. 3. A user follows the documented installation process and clones the modified default branch. 4. The user runs `bash install.sh`, causing attacker-controlle ...[truncated 759 chars]
Remediation
View remediation
``` 3. Verify the checked-out commit and published artifact using a trusted signature or checksum before execution. 4. Do not use `install.sh` itself as the long-running MCP entry point. Configure a fixed, reviewed executable after installation. 5. Do not automatically execute newly downloaded shell scripts. 6. Run the external component in a sandbox with only required filesystem and network access. 7. Supply a separate least-privileged Feishu application credential rather than credentials shared with unrelated skills. 8. Document the exact reviewed upstream revision and establish a controlled update-review process. ]]>

T06 · System Persistence

Error
Location
skills/feishu-bridge/setup-service.mjs:29
Finding

Persistent macOS Launch Agent Keeps the Credential-Bearing Bridge Running

Content
View full analysis
Label ${LABEL} ProgramArguments ${NODE_PATH} ${BRIDGE_PATH} WorkingDirectory ${WORK_DIR} RunAtLoad KeepAlive EnvironmentVariables HOME ${HOME} PATH /opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin FEISHU_APP_ID ${APP_ID} FEISHU_APP_SECRET_PATH ${SECRET_PATH} StandardOutPath ${HOME}/.clawdbot/logs/feishu-bridge.out.log StandardErrorPath ${HOME}/.clawdbot/logs/feishu-bridge.err.log `; // Ensure logs dir fs.mkdirSync(`${HOME}/.clawdbot/logs`, { recursive: true }); const outPath = path.join(HOME, 'Library', 'LaunchAgents', `${LABEL}.plist`); fs.mkdirSync(path.dirname(outPath), { recursive: true }); fs.writeFileSync(outPath, plist); ``` ### Technical Analysis The setup program creates a LaunchAgent under the user's `~/Library/LaunchAgents` directory. `RunAtLoad` causes the bridge to start when the agent is loaded, including subsequent login sessions, and `KeepAlive` instructs launchd to restart it after termination. An always-running service is relevant to a real-time Feishu bridge, and the repository documents the behavior. Nevertheless, it crosses the privilege ...[truncated 1463 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/feishu-card/handle_event.js:7
Finding

Shell Command Injection Through Untrusted Feishu Event Fields

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/feishu-card/send_safe.js:30
Finding

The “Safe” Card Sender Is Still Vulnerable to Shell Command Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/feishu-card/send.js:82
Finding

Secret-Detection Failure Falls Back to Sending the Rejected Secret

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skills/feishu-bridge/bridge.mjs:103
Finding

Untrusted Feishu Messages Are Forwarded to an Operator-Scoped Local Agent

Content
View full analysis
{ let placeholderId = ''; let done = false; // ... let reply = ''; try { reply = await askClawdbot({ text, sessionKey }); } catch (e) { reply = `（系统出错）${e?.message || String(e)}`; } ``` ### Technical Analysis The message handler checks message type and applies a response heuristic in group chats, but it does not authorize the sender or chat. There is no sender allowlist, chat allowlist, identity-to-role mapping, or approval check before forwarding text to the agent. Mentions, question punctuation, common request verbs, or a bot-like prefix are sufficient to trigger forwarding in a group. These are relevance heuristics, not access ...[truncated 1594 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skills/feishu-memory-recall/index.js:22
Finding

Feishu Bearer Token Is Cached Without Restrictive File Protections

Content
View full analysis
Date.now() / 1000) return data.token; } catch (e) {} } // Try to get fresh token const appId = process.env.FEISHU_APP_ID; const appSecret = process.env.FEISHU_APP_SECRET; if (!appId || !appSecret) throw new Error('No valid token. Set FEISHU_APP_ID and FEISHU_APP_SECRET.'); const res = await fetch(`${FEISHU_API}/auth/v3/tenant_access_token/internal`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ app_id: appId, app_secret: appSecret }) }); const data = await res.json(); if (data.code !== 0) throw new Error(`Token error: ${data.msg}`); const tokenData = { token: data.tenant_access_token, expire: Math.floor(Date.now() / 1000) + data.expire - 60 }; fs.writeFileSync(TOKEN_PATH, JSON.stringify(tokenData)); return tokenData.token; } ``` ### Technical Analysis The tenant bearer token is stored in plaintext using `fs.writeFileSync` without a restrictive `mode`, ownership validation, atomic creation, or symlink checks. Its effective permissions depend on the process umask and whether the destination already exists. The code also uses a predictable path inside the project-level `memory` directory. If ...[truncated 1175 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/feishu-bridge/package.json:6
Finding

Persistent Bridge Uses Floating Dependencies Without a Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (121)

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The README instructs users to store long-lived application secrets in a plaintext local .env-style file under the home directory. Even with good intentions, this increases the chance of accidental disclosure through backups, misconfigured permissions, shell tooling, logs, or later reuse by other local processes.

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

md
export FEISHU_APP_ID="cli_a5xxxxxxxxxxxxx"
export FEISHU_APP_SECRET="your_app_secret_here"

# 方式二：.env 文件
cat > ~/.feishu-skills.env << 'EOF'
FEISHU_APP_ID=cli_a5xxxxxxxxxxxxx
FEISHU_APP_SECRET=your_app_secret_here

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared behavior is a broad Feishu skill suite, but the analysis indicates additional undeclared local file reads/writes and session-store access, including discovery of local OpenClaw session data. Undisclosed access to local memory logs, token caches, and session metadata materially changes the trust model and can expose sensitive data beyond the stated purpose.

Content

No source excerpt is available for this finding.

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The instructions direct users to place Feishu App ID and App Secret into ~/.claude/mcp.json, a shared local configuration path that may be readable by other skills or tools in the same environment. Storing long-lived API credentials in broadly accessible config files increases the risk of credential theft and abuse of the connected Feishu tenant.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
# Install all skills
clawhub install feishu-skills-kit --dir ~/.claude/skills

# Configure MCP (edit ~/.claude/mcp.json)
# Add your FEISHU_APP_ID and FEISHU_APP_SECRET
# See mcp-config-template.json for reference

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

md
"<FEISHU_DOC_MANAGER_INSTALL_PATH>": "feishu-doc-manager 仓库克隆后的本地路径",
    "<FEISHU_MCP_SERVER_PATH>": "飞书 MCP Server 的安装路径"
  },
  "_instructions": "1. 将此文件内容合并到 ~/.claude/mcp.json 中；2. 替换所有 <PLACEHOLDER> 为实际值；3. 删除 _comment、_placeholders、_instructions 字段；4. 重启 Claude Code"
}

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · README.md (reported line 536)May include surrounding context.

md
"<FEISHU_DOC_MANAGER_INSTALL_PATH>": "feishu-doc-manager 仓库克隆后的本地路径",
    "<FEISHU_MCP_SERVER_PATH>": "飞书 MCP Server 的安装路径"
  },
  "_instructions": "1. 将此文件内容合并到 ~/.claude/mcp.json 中；2. 替换所有 <PLACEHOLDER> 为实际值；3. 删除 _comment、_placeholders、_instructions 字段；4. 重启 Claude Code"
}

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · mcp-config-template.json (reported line 32)May include surrounding context.

json
"<FEISHU_DOC_MANAGER_INSTALL_PATH>": "feishu-doc-manager 仓库克隆后的本地路径",
    "<FEISHU_MCP_SERVER_PATH>": "飞书 MCP Server 的安装路径"
  },
  "_instructions": "1. 将此文件内容合并到 ~/.claude/mcp.json 中；2. 替换所有 <PLACEHOLDER> 为实际值；3. 删除 _comment、_placeholders、_instructions 字段；4. 重启 Claude Code"
}

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-card/send.js (reported line 6)May include surrounding context.

js
const { program } = require('commander');
const path = require('path');
const crypto = require('crypto');
require('dotenv').config({ path: require('path').resolve(__dirname, '../../.env'), quiet: true }); 

// Optimization: Use shared client with Auth Refresh & Retry
const { fetchWithAuth } = require('../feishu-common/index.js');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-memory-recall/index.js (reported line 18)May include surrounding context.

js
const { program } = require('commander');
const path = require('path');
const crypto = require('crypto');
require('dotenv').config({ path: require('path').resolve(__dirname, '../../.env'), quiet: true }); 

// Optimization: Use shared client with Auth Refresh & Retry
const { fetchWithAuth } = require('../feishu-common/index.js');

Ssd 1

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The inline comment says a strict length check was removed 'to allow longer prompt injection via args if needed,' which semantically endorses facilitating prompt-injection content rather than merely discussing security. This is not a benign mention of security concepts; it describes a design choice that enables injection-style payload delivery through natural-language input.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This is a true command injection vulnerability. Although the message body is moved into a temporary file, the script still interpolates user-controlled values like --target, --color, and especially --title directly into a shell command string and executes it with execSync, which invokes a shell; embedded quotes or shell metacharacters can break out of the intended argument context and run arbitrary commands. In this skill context, the danger is elevated because Feishu automation is likely to run with user tokens, bot credentials, local filesystem access, and CI/agent permissions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-doc-editor/SKILL.md (reported line 22)May include surrounding context.

md
**Publish app**: Submit version and publish, ensuring the app coverage includes target users/departments.

### 2. Get Access Token

Call the self-built app get tenant_access_token interface:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-doc-editor/SKILL.md (reported line 117)May include surrounding context.

md
**Publish app**: Submit version and publish, ensuring the app coverage includes target users/departments.

### 2. Get Access Token

Call the self-built app get tenant_access_token interface:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/feishu-doc-editor/references/api-guide.md (reported line 177)May include surrounding context.

接口：

text
DELETE /docx/v1/documents/{document_id}/blocks/{block_id}

响应示例：

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · skills/feishu-docx-powerwrite/SKILL.md (reported line 6)May include surrounding context.

md
description: High-quality Feishu/Lark Docx writing via OpenClaw. Use when you want to turn Markdown into well-formatted Feishu Docx (headings, lists, nesting, code blocks) using feishu_docx_write_markdown; includes safe workflows, templates, and troubleshooting. Trigger on Feishu doc/docx links, “write to Feishu doc”, “generate a Feishu doc”, “append/replace docx”, “convert markdown to feishu doc”, or when users want consistently good doc formatting.
---

# Feishu Docx PowerWrite

This skill focuses on **reliably writing great-looking Feishu Docx** using OpenClaw’s Feishu OpenAPI tools.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-sheets-skill/references/api-reference.md (reported line 11)May include surrounding context.

Authentication

All API calls require a tenant access token in the Authorization header:

text
Authorization: Bearer {tenant_access_token}

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/feishu-sheets-skill/references/api-reference.md (reported line 149)May include surrounding context.

md
### 7. Delete Rows/Columns

**Endpoint:** `DELETE /sheets/v2/spreadsheets/{spreadsheet_token}/dimension_range`

**Request Body:** Same as insert

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/feishu-sheets-skill/scripts/feishu_sheets.py (reported line 25)May include surrounding context.

python
self._token = None
        
    def _get_token(self) -> str:
        """Get tenant access token"""
        if self._token:
            return self._token

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

md
FEISHU_APP_ID=cli_a5xxxxxxxxxxxxx
FEISHU_APP_SECRET=your_app_secret_here
EOF
chmod 600 ~/.feishu-skills.env

# 方式三：安全文件（feishu-bridge 使用）
mkdir -p ~/.clawdbot/secrets

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

This duplicated finding covers the same persistent plaintext secret storage under ~/.clawdbot/secrets. Although intended as secure local storage, it still increases exposure by creating a durable, discoverable credential target on disk.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

chmod 600 ~/.feishu-skills.env

方式三：安全文件（feishu-bridge 使用）

mkdir -p ~/.clawdbot/secrets echo "your_app_secret_here" > ~/.clawdbot/secrets/feishu_app_secret chmod 600 ~/.clawdbot/secrets/feishu_app_secret

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

This duplicated finding covers the same persistent plaintext secret storage under ~/.clawdbot/secrets. Although intended as secure local storage, it still increases exposure by creating a durable, discoverable credential target on disk.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

chmod 600 ~/.feishu-skills.env

方式三:安全文件(feishu-bridge 使用)

mkdir -p ~/.clawdbot/secrets echo "your_app_secret_here" > ~/.clawdbot/secrets/feishu_app_secret chmod 600 ~/.clawdbot/secrets/feishu_app_secret

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The README tells users to git clone a remote repository and conditionally execute install.sh with bash, which is arbitrary code execution from an external source. This is especially risky in a setup guide because users may run it without reviewing the script, and the script can persist changes, install additional components, or access local secrets.

Content

Scanner excerpt · README.md (reported line 167)May include surrounding context.

bash
# 克隆 MCP Server
cd ~/.openclaw/workspace/skills 2>/dev/null || mkdir -p ~/.openclaw/workspace/skills && cd ~/.openclaw/workspace/skills
git clone https://github.com/Shuai-DaiDai/feishu-doc-manager.git
cd feishu-doc-manager
# 如果有 install.sh 则执行

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 241)May include surrounding context.

md
clawhub login

# 安装单个 skill
clawhub install feishu-doc-manager --dir ~/.claude/skills

# 批量安装所有飞书 skills
for skill in feishu-doc-manager feishu-docx-powerwrite feishu-doc-editor \

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 247)May include surrounding context.

md
clawhub login

# 安装单个 skill
clawhub install feishu-doc-manager --dir ~/.claude/skills

# 批量安装所有飞书 skills
for skill in feishu-doc-manager feishu-docx-powerwrite feishu-doc-editor \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 244)May include surrounding context.

md
clawhub install feishu-doc-manager --dir ~/.claude/skills

# 批量安装所有飞书 skills
for skill in feishu-doc-manager feishu-docx-powerwrite feishu-doc-editor \
  feishu-messaging feishu-card feishu-sheets-skill feishu-bitable \
  feishu-bridge feishu-memory-recall feishu-leave-request; do
  clawhub install "$skill" --dir ~/.claude/skills --force

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The plist reference indicates creation/loading of a LaunchAgent for recurring execution. While not inherently malicious, persistence mechanisms should be treated carefully because they survive restarts and can continuously access configured credentials or relay messages if the bridge is abused.

Content

Scanner excerpt · README.md (reported line 443)May include surrounding context.

macOS 开机自启：

bash
FEISHU_APP_ID=cli_xxx node setup-service.mjs
launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist