feishu-team-manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 2.4.3

Overview

This skill appears aimed at real Feishu/Discord agent management, but it asks for powerful local and bot access with weak safeguards around credentials, global configuration changes, and persistent agent authority.

Review this skill carefully before installing. Use it only in a test or tightly controlled OpenClaw environment, do not paste real App Secrets or bot tokens into chat, restrict bot senders before enabling routing, back up ~/.openclaw manually before running it, and avoid running the bundled test or binding scripts against production configuration until the unsafe shell calls, plaintext secret storage, open-DM defaults, and confirmation gaps are fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:112
• Finding: Shell Command Injection Through Unquoted Workspace Paths<![CDATA[ ## Vulnerability Details **File Location**: `index.js`, lines 112–138 and 157–163 **Vulnerability Type**: Shell command injection through unquoted, configuration-derived paths **Risk Level**: Critical ### Vulnerable Code ```javascript const hrWorkspace = path.join(process.env.HOME || '/root', '.openclaw/hr_recruiter_workspace'); if (!fs.existsSync(hrWorkspace)) { console.log(`Creating HR workspace: ${hrWorkspace}`); execSync(`mkdir -p ${hrWorkspace}/skills`); } const templates = ['identity', 'soul', 'agents']; templates.forEach(t => { const src = path.join(skillSourcePath, 'assets/templates', `hr_${t}.md`); const dst = path.join(hrWorkspace, `${t.toUpperCase()}.md`); if (fs.existsSync(src)) { execSync(`cp ${src} ${dst}`); } }); const targetSkillPath = path.join(hrWorkspace, 'skills/feishu-team-manager'); execSync(`rm -rf ${targetSkillPath}`); execSync(`mkdir -p ${targetSkillPath}`); execSync(`cp -r ${skillSourcePath}/* ${targetSkillPath}/`); execSync(`openclaw agents add hr_recruiter --workspace ${hrWorkspace}`); ``` The same unsafe pattern occurs during synchronization: ```javascript const hrWorkspace = hrAgent.workspace; if (hrWorkspace && fs.existsSync(hrWorkspace)) { const targetSkillPath = path.join(hrWorkspace, 'skills/feishu-team-manager'); execSync(`cp -r ${skillSourcePath}/* ${targetSkillPath}/`); console.log("Skill files synchronized to the HR workspace."); } ``` ### Technical Analysis The code constructs shell command strings by directly interpolating paths derived from: - The `HOME` environment variable. - The Skill installation path. - The `workspace` property in `openclaw.json`. No shell quoting, escaping, canonicalization, or trust-boundary validation is applied. Node.js `execSync()` invokes a shell, so metacharacters embedded in one of these values are interpreted as shell syntax rather than as part of a filesystem path. The synchronization branch is particularly dangerous because ...[truncated 1293 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not invoke a shell for filesystem operations. Replace the commands with native Node.js APIs: - `fs.mkdirSync(path, { recursive: true })` - `fs.cpSync(source, destination, { recursive: true })` - `fs.rmSync(path, { recursive: true, force: true })` 2. If an external command is unavoidable, use `execFileSync()` or `spawnSync()` with an argument array and `shell: false`. 3. Resolve each path with `fs.realpathSync()` or `path.resolve()` and verify that it remains beneath an explicitly approved OpenClaw workspace root. 4. Reject workspace values containing null bytes, control characters, or unexpected path structures. 5. Before any recursive deletion, verify that the target: - Is not empty. - Is not `/` or the user's home directory. - Is a child of the expected Skill directory. 6. Treat values loaded from `openclaw.json` as untrusted configuration rather than safe shell input. ]]>

T02 · Agent Memory Poisoning

Error

• Location: scripts/recruit_agent.py:5
• Finding: Persistent Agent Instruction Injection and Path Traversal Through Recruitment Inputs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recruit_agent.py`, lines 5–20 **Vulnerability Type**: Persistent instruction injection and unsanitized filesystem path construction **Risk Level**: High ### Vulnerable Code ```python def recruit(agent_name, role_template): print(f"Recruiting Agent: {agent_name}...") try: subprocess.run(["openclaw", "agents", "add", agent_name], check=True) except Exception as e: return f"Failed to add Agent: {str(e)}" agent_path = f"agents/{agent_name}" full_agent_path = os.path.expanduser(f"~/.openclaw/agents/{agent_name}") if os.path.exists(full_agent_path): with open(f"{full_agent_path}/IDENTITY.md", "w") as f: f.write(f"# IDENTITY\nname: {agent_name}\nrole: {role_template}") ``` ### Technical Analysis Both `agent_name` and `role_template` are accepted from command-line arguments without validation. The `role_template` value is written verbatim into a persistent `IDENTITY.md` file. If OpenClaw loads this file as part of the Agent's instructions, an attacker can supply multiline Markdown or instruction text that changes the Agent's future behavior. This turns a one-time recruitment input into persistent state affecting later sessions. The `agent_name` value is also interpolated into a filesystem path. Although the OpenClaw CLI is invoked safely with an argument array, the later file operation does not reject path separators or traversal sequences. If the CLI accepts the supplied name, or if a selected traversal destination already exists, the script may overwrite an unintended `IDENTITY.md`. ### Attack Path 1. An attacker or untrusted user invokes the recruitment workflow with a crafted role value containing additional Agent instructions. 2. The script passes the Agent name to OpenClaw and then writes the crafted role verbatim to `IDENTITY.md`. 3. The recruited Agent loads the persistent identity file in future sessions. 4. The injected instructio ...[truncated 861 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only strict Agent identifiers, for example: ```python if not re.fullmatch(r"[A-Za-z0-9_-]{1,64}", agent_name): raise ValueError("Invalid Agent identifier") ``` 2. Reject path separators, traversal components, control characters, and absolute paths. 3. Resolve the destination with `os.path.realpath()` and verify it remains beneath the canonical `~/.openclaw/agents` directory. 4. Do not write arbitrary role text into instruction files. 5. Accept only predefined role identifiers and map them to trusted, static templates maintained by the Skill. 6. If custom descriptions are required, store them as quoted data in a non-instruction field and apply length and character restrictions. 7. Require explicit confirmation showing the exact destination and generated identity content before writing. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: assets/templates/hr_identity.md:10
• Finding: Persistent HR Templates Grant Excessive and Exclusive Agent Authority<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/templates/hr_identity.md`, lines 10–14 - `assets/templates/hr_soul.md`, lines 3–12 - `assets/templates/hr_agents.md`, lines 9–12 **Vulnerability Type**: Persistent instruction-based authority expansion **Risk Level**: High ### Vulnerable Content The HR identity template declares that the installed Agent is the sole manager with absolute authority: ```markdown identity_description: - The Agent is the management core of the automated Agent team. - Its duty is to onboard new Agents automatically according to the owner's instructions. - It is the company's only manager authorized to recruit Agents and install management Skills. - It has absolute management authority over Worker Agents and is responsible for permission interception. ``` The persistent behavioral template prioritizes immediate execution: ```markdown ## Core Rules 1. Permission gatekeeper: You are the company's only recruiter. 2. Automation first: Recruitment processes that can be completed with scripts must not be handled manually. 3. Isolation first: Every employee must have a separate workspace and Feishu bot. 4. Act immediately: When the owner issues an instruction, execute it without delay. ## Behavioral Boundary - Every newly created Agent must receive `role: "worker"` and `parent: "hr_recruiter"` in `openclaw.json`. - You are the management specialist delegated by the main Agent. ``` The Agent handbook reinforces exclusive control: ```markdown ## Management Permissions - I hold the only feishu-team-manager permission. - Worker Agents are strictly prohibited from accessing the openclaw.json configuration file. ``` ### Technical Analysis The first-run deployment copies these templates into persistent OpenClaw Agent control files. The instructions grant the new Agent exclusive management authority, direct it to alter global configuration, and encourage immediate automated execution. The templates do not explicitly subordina ...[truncated 1347 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove language asserting absolute or exclusive authority. 2. Explicitly state that the HR Agent remains subordinate to platform safety policies and authenticated user authorization. 3. Define an allowlist of management operations rather than granting broad management authority. 4. Require confirmation for: - Agent creation. - Global configuration changes. - Skill installation. - Credential binding. - Gateway restart. 5. Require authentication or trusted-channel verification before treating a message as an owner instruction. 6. Separate public bot messaging capabilities from privileged management tools. 7. Add a clear refusal rule for instructions that request credential disclosure, safety bypasses, or operations outside the configured workspace. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bind_bot.py:43
• Finding: Bot Credentials Are Collected and Stored Through Insecure Plaintext Channels<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/cards/recruit_hr.json`, lines 19–24 - `scripts/bind_bot.py`, lines 43–47 and 87–90 - `scripts/add_discord_config.py`, lines 95–96, 144–150, 159–175, and 203–204 **Vulnerability Type**: Plaintext secret collection, command-line exposure, storage, and logging **Risk Level**: High ### Vulnerable Code The recruitment card requests the App Secret as ordinary form or conversational input: ```json { "header": "App Secret", "question": "Enter the HR bot's App Secret", "options": [], "multiSelect": false } ``` The Feishu binding script stores the supplied secret directly in `openclaw.json`: ```python config["channels"]["feishu"]["accounts"][account_id] = { "appId": app_id, "appSecret": app_secret, "enabled": True, "dmPolicy": "open" } ``` The script also accepts the secret through command-line arguments: ```python if __name__ == "__main__": if len(sys.argv) > 3: print(bind_bot(sys.argv[1], sys.argv[2], sys.argv[3])) ``` Discord configuration supports direct plaintext token embedding: ```python if use_env_ref: discord_config["token"] = { "source": "env", "provider": "default", "id": "DISCORD_BOT_TOKEN" } else: discord_config["token"] = token ``` The direct-token mode is exposed through the CLI: ```python parser.add_argument('--token', help='Discord bot token') parser.add_argument('--direct-token', action='store_false', dest='env_ref', help='Embed token directly') ``` The resulting Discord configuration is printed before writing: ```python print(json.dumps(config_data['channels']['discord'], indent=2, ensure_ascii=False)) ``` ### Technical Analysis Feishu App Secrets are collected through a normal chat/card workflow, where they may be retained in conversation history or platform logs. They are then passed through command-line arguments and stored as plaintext JSON values. Command-line secrets may be exp ...[truncated 1521 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not request secrets through ordinary chat messages or persistent interactive cards. 2. Use a protected secret-entry mechanism that does not retain values in conversation history. 3. Store only secret-manager or environment-variable references in `openclaw.json`. 4. Remove Discord's `--direct-token` mode. 5. Do not accept credentials through command-line arguments; use protected standard input, a credential helper, or a secret manager. 6. Never print configuration structures that may contain credentials. 7. Ensure configuration and backup files use restrictive permissions such as mode `0600`. 8. Define a secure retention and deletion policy for credential-bearing backups. 9. Rotate any credential that has already been entered through chat, exposed in process arguments, or printed to a terminal. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bind_bot.py:16
• Finding: Global Configuration Is Mutated and the Gateway Is Restarted Without Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/bind_bot.py`, lines 16–19 and 64–84 **Vulnerability Type**: Unauthorized global configuration repair, rewrite, and service restart **Risk Level**: High ### Vulnerable Code The script starts with a mutating repair operation before creating a backup: ```python print("Running pre-modification check...") pre_check = subprocess.run( ["openclaw", "doctor", "--fix"], capture_output=True, text=True ) if pre_check.returncode != 0: print("The original configuration contained errors; automatic repair was attempted.") ``` It subsequently writes global configuration and performs further repair operations: ```python with open(config_path, "w") as f: json.dump(config, f, indent=2) post_check = subprocess.run( ["openclaw", "doctor", "--fix"], capture_output=True, text=True ) if post_check.returncode != 0 or "ERROR" in post_check.stdout: if "AppId" in post_check.stdout or "Secret" in post_check.stdout: return "Credential validation failed." print("A non-fatal exception was detected; attempting a second automatic correction...") subprocess.run(["openclaw", "doctor", "--fix"]) ``` Finally, it restarts the gateway without a user-confirmation boundary: ```python print("Environment ready; restarting Gateway...") subprocess.run(["openclaw", "gateway", "restart"]) ``` ### Technical Analysis `openclaw doctor --fix` is a mutating command. The first invocation occurs before `bind_bot.py` creates its backup, so changes made by that invocation cannot be recovered using the script's later backup. The function then overwrites the global OpenClaw configuration, may invoke the repair command two more times, and restarts the gateway. There is no interactive confirmation or dry-run boundary in this script. This contradicts the Skill documentation's claim that high-privilege bot-binding operations require user consent and that backups are created before all configuration ...[truncated 976 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create and verify a backup before the first mutating command. 2. Run a non-mutating diagnostic command before offering `--fix`. 3. Display the proposed configuration diff and require explicit confirmation. 4. Require separate confirmation before: - Running automatic repairs. - Writing global configuration. - Restarting the gateway. 5. Add a non-interactive safety policy that rejects mutation unless an explicit authorization flag is supplied. 6. Use atomic writes and automatically restore the backup if validation fails. 7. Do not restart the gateway automatically; return a clear instruction or require a dedicated `--restart` option. 8. Document all global side effects accurately. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/add_discord_config.py:70
• Finding: New Feishu and Discord Bots Permit Unrestricted Direct Messages by Default<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/add_discord_config.py`, lines 70–84 - `scripts/bind_bot.py`, lines 43–48 **Vulnerability Type**: Insecure access-control defaults for Agent-facing bot channels **Risk Level**: High ### Vulnerable Code The Discord configuration allows every sender: ```python discord_config = { "enabled": True, "streaming": True, "footer": { "elapsed": True, "status": True }, "accounts": { "default": { "dmPolicy": "open", "allowFrom": ["*"] } } } ``` Feishu accounts are also configured with an open direct-message policy: ```python config["channels"]["feishu"]["accounts"][account_id] = { "appId": app_id, "appSecret": app_secret, "enabled": True, "dmPolicy": "open" } ``` ### Technical Analysis Both channel configurations default to accepting direct messages from untrusted users. Discord explicitly uses the wildcard `allowFrom: ["*"]`. These channels route messages to Agents that participate in recruitment, bot binding, and configuration-management workflows. Exposing them to all platform users materially increases the prompt-injection and unauthorized-use attack surface. A public conversational endpoint should not share the same trust level or tool permissions as an authenticated management endpoint. ### Attack Path 1. The user runs the binding or Discord configuration script. 2. The generated bot account is enabled with an open direct-message policy. 3. An arbitrary Feishu or Discord user discovers or contacts the bot. 4. The external user submits adversarial instructions or prompt-injection content. 5. The message is routed to the associated Agent. 6. If the Agent treats the sender as trusted or has access to management tools, the attacker may trigger recruitment, routing changes, information disclosure, or resource-consuming operations. ### Impact Assessment The precise result depends on downstream Agent aut ...[truncated 468 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to a deny-by-default direct-message policy. 2. Require explicit sender allowlists using verified user, tenant, server, or organization identifiers. 3. Require a secure pairing procedure before accepting commands. 4. Authenticate privileged commands independently of the messaging channel. 5. Separate public conversational Agents from privileged management Agents and tools. 6. Apply least-privilege tool permissions to all remotely reachable Agents. 7. Reject management operations originating from public channels unless separately approved through a trusted local channel. 8. Log authentication failures and rate-limit untrusted senders without recording sensitive message content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (84)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Undeclared installation actions, environment checks, script execution, network fetches, and verification of external links extend the trust boundary beyond the stated team-management task. In a skill that already handles credentials and local configuration, hidden install/test/network behavior increases the chance of unintended code execution, disclosure, or policy bypass.

Ae1

High

• Category: analysis-evasion

Content

当此 Skill 首次运行时，`index.js` 会：

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill’s declared purpose is Feishu/Discord bot setup and routing refactor, but the implementation instead provisions a new OpenClaw agent workspace, injects identity files, copies the entire skill tree, and alters agent registration. This mismatch is dangerous because users may grant trust based on the manifest while the code performs privileged local persistence and cross-workspace modification unrelated to the stated function.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example instructs the user to send `App ID` and especially `Secret` in a conversational message to the HR agent, effectively modeling secret disclosure through chat. This is dangerous because chat transcripts, logs, prompt history, or other agents may capture the credential, enabling bot takeover or broader compromise of connected Feishu integrations.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### 步骤2: 验证技能文件结构
```bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/

# 检查核心文件
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/scripts/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### 步骤2: 验证技能文件结构
```bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/

# 检查核心文件
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/scripts/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### 步骤2: 验证技能文件结构
```bash
# 检查技能目录
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/

# 检查核心文件
ls -la ~/.openclaw/workspace/skills/feishu-team-manager/scripts/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance says the skill can be triggered by merely mentioning keywords in conversation, but does not define boundaries, confirmation prompts, or safe activation conditions. In a team-management skill that can recruit agents and configure bots, ambiguous triggers increase the chance of accidental invocation and unintended operational changes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation labels the command as a simulation, but the shown invocation has no explicit dry-run or test-only safeguard. If users trust the documentation, they may execute the real recruitment workflow and unintentionally create agents, modify routing, or trigger downstream bot/account provisioning in production environments.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documentation describes external API integration and automated deployment behavior that exceeds the narrow expectations of a recruitment/bot-routing skill. Capability creep increases attack surface and creates a mismatch between user expectations and actual privileged operations, making social engineering and unsafe approval more likely.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The quick-start explicitly normalizes security warnings and states the skill performs configuration modification, system command execution, and deployment automation. Even in documentation, encouraging force-installation of a package with those capabilities broadens trust requirements and can lead users to approve powerful behavior without validation. In the context of a team-management skill, this is more dangerous because the advertised capabilities imply host-level changes beyond simple recruiting and bot routing.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide instructs users to paste Feishu App ID and Secret directly into chat, without any warning about retention, logging, redaction, or safer secret-entry mechanisms. Secrets entered in conversational channels may be stored in transcripts, exposed to other agents/tools, or leaked through debugging and monitoring systems.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: This section directly teaches users to supply bot credentials in conversational prompts, which is an unsafe secret-handling pattern. In an agent ecosystem, chat content may be logged, forwarded, used for context in later tasks, or accessed by plugins, turning a documentation pattern into a real credential exposure risk.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The repeated examples normalize verbatim inclusion of App IDs and Secrets in agent conversations, reinforcing insecure operator behavior. Repetition matters here because it trains users to treat sensitive values as ordinary prompt content, increasing the probability of accidental disclosure and long-term transcript leakage.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares powerful capabilities through metadata and documented behavior—environment access, local file modification, shell execution, and likely network use—but does not define an explicit tool/permission scope. This weakens least-privilege controls and makes it harder for a host or reviewer to constrain dangerous operations such as rewriting OpenClaw configuration, restarting services, or handling bot credentials.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Broad natural-language trigger phrases with no activation constraints make accidental or socially engineered invocation more likely, especially for a skill that can create workspaces, modify config, and restart services. In this context, an innocuous chat message containing phrases like 'recruit' or 'bind bot' could trigger sensitive actions without sufficiently clear scoping.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The form explicitly asks a user to enter an App Secret, which is a sensitive credential, but provides no scope limitation, justification, handling notice, or indication of a secure collection flow. In the context of a skill that provisions bots and multi-account routing, collecting raw secrets through a generic form materially increases the risk of credential theft, overbroad access, or accidental disclosure in logs, cards, or downstream systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The workflow instructs creation of local workspaces, agent provisioning, and collection/binding of Feishu bot credentials without any warning, confirmation, or safe-handling guidance. In a high-privilege HR/team-management skill, this can lead to unintended filesystem modification, unsafe secret handling, and users providing credentials to an automation flow without understanding the security implications.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:44