ClawHub
Back to skill

Security audit

send image in feishu

Security checks for vulnerabilities and agentic risk

Overview

The skill does send Feishu images as advertised, but it exposes and uses Feishu app credentials in a way users should review before installing.

Review this skill before installation. Do not use the embedded Feishu secret; rotate it if it is real, remove hardcoded credentials, use a managed secret source, and require explicit confirmation of the Feishu account, recipient, and exact image path before sending.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to retrieve Feishu app credentials from local configuration and also hard-codes a live app secret. That exceeds simple image-sending guidance and enables credential disclosure and reuse for broader API access, which is especially risky because the secret is sufficient to mint tenant access tokens.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill combines secret handling, direct script generation, and outbound transmission to Feishu without any warning that credentials and local image data will be sent to an external service. This creates a meaningful risk of unreviewed data exfiltration and secret exposure during normal use.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The skill assumes a specific organizational account context ('CTO agent') and provides a concrete account ID and secret without requiring user opt-in or confirming scope. In practice this can cause the agent to act under privileged organizational credentials by default, increasing the blast radius of misuse.

Static analysis

No suspicious patterns detected.