Openclaw San Sheng Liu Bu Lobster

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:40 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Feishu-based multi-agent task workflow, but it ships live-looking Feishu destinations and makes cloud posting and tracking mandatory without enough user control.

Review this skill carefully before installing. Replace all bundled Feishu OpenIDs, chat IDs, app/table tokens, URLs, and folder destinations with resources you control, and do not use it on sensitive tasks unless you are comfortable with outputs, task metadata, local paths, and document links being posted to Feishu and stored in Bitable. Prefer a local-only or explicit-confirmation workflow for confidential material.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: config/lobster-team.md:13

Finding

Hardcoded Feishu recipients and data destinations can cause cross-tenant disclosure

Content

View full analysis

Vulnerability Details

File Location: config/lobster-team.md:13-20, config/lobster-team.md:62-89, SKILL.md:64-69, README.md:135-140, docs/task-tracking.md:229-246
Vulnerability Type: Hardcoded external service identifiers and unsafe destination configuration
Risk Level: High

Vulnerable Code

config/lobster-team.md:13-20:

markdown

| 编号 | 角色 | 飞书机器人名称 | OpenID | 专长 | 典型任务 | 状态 |
|------|------|--------------|--------|------|---------|------|
| 龙虾 1 号 | 资料收集专家 | 第二大脑笔记助手 | `ou_f243f998e0eaf197cb6eebb82a324ece` | 资料收集、信息提取 | 文档分析、重点提炼 | ✅ 已激活 |
| 龙虾 2 号 | 内容创作高手 | 通用内容创作虾 | `ou_eb8596a8c080a61425f442c200466144` | 文章写作、内容生成 | 推广文章、长文写作 | ✅ 已激活 |
| 龙虾 3 号 | 朋友圈文案王 | 朋友圈创作虾 | `ou_2fe945f6c97c78712904ff06ee17595b` | 短文案、社交内容 | 朋友圈文案、社群分享 | ✅ 已激活 |
| 龙虾 4 号 | 视频脚本导演 | 电商 Seedance 导演虾 | `ou_a632a99021af38c5c8db5c1ff148ba11` | 视频提示词 | 电商视频脚本、短视频 | ✅ 已激活 |
| 龙虾 5 号 | 图片素材达人 | 图片素材生成虾 | `ou_0556824ddd755711afc35ab8e67f52b9` | 图片搜索、视觉设计 | 找素材、配图、保存 | ✅ 已激活 |
| 龙虾 6 号 | 飞书文档管家 | 飞书工作助手 | `ou_c142533e95ce10cec4a4cbf78661e09d` | 飞书文档处理、会议纪要 | 文档整理、汇总、格式化 | ✅ 已激活 |

config/lobster-team.md:62-89:

markdown

### 指挥群信息

| 项目 | 详情 |
|------|------|
| 群名称 | 来合火 OpenClaw 指挥中心 |
| 群 ID | `oc_8faef5990acd30c853ad72f01fcb8f09` |
| 用途 | 任务分配通知、进度追踪、完成汇报 |
| 成员 | 所有龙虾机器人 + 主助手 |

### 通知规则

| 时机 | 通知内容 | @对象 | 方式 |
|------|---------|------|------|
| 任务分配 | 任务拆解详情 | @所有龙虾 | 群通知 |
| 单个任务 | 具体任务指令 | @对应龙虾 | 群@ + 私聊 |
| 任务完成 | 完成情况汇报 | @所有龙虾 | 群通知 |
| 全部完成 | 完整成果交付 | @所有龙虾 | 群通知 |

---

## 飞书多维表格配置

### 表格信息

| 项目 | 详情 |
|------|------|
| 表格名称 | OpenClaw 龙虾任务执行记录 |
| 表格 Token | `HxULbN8KTaIkCxsTmvYcg4ldnhh` |
| 表格链接 | https://fvqga1bpis.feishu.cn/base/HxULbN8KTaIkCxsTmvYcg4ldnhh |

SKILL.md:64-69:

python

feishu_bitable_app_table_record(
    action="batch_create",
    app_token="HxULbN8KTaIkCxsTmvYcg4ldnhh",
    table_id="tblAAxJLFpXO7k1X",
    records
...[truncated 2288 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all concrete OpenIDs, chat IDs, table IDs, application tokens, tenant URLs, and folder identifiers from the distributed package.
2. Replace them with unmistakable placeholders such as YOUR_FEISHU_CHAT_ID and YOUR_BITABLE_APP_TOKEN.
3. Add a mandatory initialization process that collects user-owned destinations and refuses execution while placeholders or bundled defaults remain.
4. Validate that configured recipients and resources belong to the user's expected Feishu tenant.
5. Before the first message or write, display the resolved tenant, chat, document folder, and table destinations and request explicit confirmation.
6. Store environment-specific identifiers outside public Skill documentation, using a protected local configuration or secret-management mechanism where appropriate.
7. Apply least-privilege Feishu permissions so the integration can access only the user-approved chat, document folder, and table.
8. Add tests that fail package publication when live-looking OpenIDs, chat IDs, Bitable tokens, or tenant-specific URLs are detected.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: docs/auto-create-feishu-doc.md:9

Finding

Mandatory cloud replication exceeds the privileges required for ordinary task decomposition

Content

View full analysis

Vulnerability Details

File Location: docs/auto-create-feishu-doc.md:9-16, SKILL.md:154-158, SKILL.md:197-201, SKILL.md:238-242, SKILL.md:437-449, templates/task-templates.md:30-34, templates/task-templates.md:74-78, templates/task-templates.md:311-313
Vulnerability Type: Unconditional external publication and metadata distribution
Risk Level: Medium

Vulnerable Code

docs/auto-create-feishu-doc.md:9-16:

markdown

## 核心要求

**每个子龙虾产出的内容都必须：**
1. ✅ 生成本地 Markdown 文件
2. ✅ **创建飞书文档**（将 Markdown 内容创建为飞书云文档）
3. ✅ 回复时包含飞书文档链接
4. ✅ 龙虾 6 号记录飞书文档链接到多维表格的"产出链接"

SKILL.md:437-449:

markdown

## 交付要求

### 每个子龙虾必须

1. ✅ 创建本地 Markdown 文件
2. ✅ **必须创建飞书文档**
3. ✅ 回复时包含：
   ```
   ✅ 龙虾 X 号完成
   📄 本地文件：[文件路径]
   🔗 飞书文档：[飞书文档链接]
   ```

templates/task-templates.md:311-313:

markdown

1. 每个子龙虾产出都必须创建飞书文档
2. 回复时包含本地文件路径 + 飞书文档链接
3. 龙虾 6 号记录所有飞书文档链接到多维表格"产出链接"字段

Technical Analysis

The Skill makes cloud document creation and Bitable link recording mandatory for every subtask. This behavior applies even when the underlying request only requires task decomposition, local content generation, or a local Markdown artifact.

Feishu integration is part of the Skill's declared functionality, so cloud publishing is not inherently unauthorized. The security problem is that publishing is unconditional: the workflow contains no per-task consent check, sensitivity classification, destination validation, sharing-policy verification, or local-only mode.

Creating a local result requires file-write access only. Automatically duplicating that result into a cloud document, broadcasting its link, and indexing it in a table expands the trust boundary and privileges used. This exceeds minimum privilege for tasks that do not explicitly request external publication. The risk is amplified by the hardcoded destinations described in the separate finding.

Attack Path

...[truncated 1260 chars]

Remediation

View remediation

Remediation Suggestions

1. Make Feishu document creation opt-in per task rather than mandatory.
2. Default to local-only output unless the user explicitly requests cloud publication.
3. Before uploading, show the target tenant, folder, document-sharing policy, chat recipients, and Bitable destination.
4. Require explicit confirmation before the first cloud upload and before distributing document links.
5. Add sensitivity checks for credentials, personal data, confidential business material, internal URLs, and proprietary source content.
6. Redact local filesystem paths, user identifiers, and unnecessary task details from messages and Bitable records.
7. Permit independent configuration of document creation, messaging, progress tracking, and Bitable recording so users can grant only the capabilities required for a task.
8. Use restrictive document permissions by default and avoid public-link sharing.
9. Document retention and deletion controls for generated documents and task-tracking records.
10. If a task is classified as sensitive, require local-only processing unless an authorized user explicitly overrides the restriction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This template explicitly instructs recording OpenIDs, robot names, task details, multiline text, and output links into Feishu tables without any minimization or access-control guidance. That combination can expose identifiers and internal document links at scale, enabling privacy leakage, unwanted correlation of users/bots, or broader access to sensitive outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly instructs the skill to send direct Feishu messages to specific OpenID recipients with task content, but provides no warning, consent step, or boundary on what data may be transmitted to third parties. This can expose personal identifiers, internal task details, or sensitive business context to external messaging recipients, especially in a multi-agent workflow where content may be automatically forwarded.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes automatic creation of Feishu documents and Bitable records containing generated content and output links, but does not warn users that their data will be stored in external SaaS systems. This creates a real risk of unintended persistence, over-sharing, and leakage of sensitive content or metadata into documents/tables that may have broader access than the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly requires sending notifications, creating Feishu documents, and updating Feishu tables, but it provides no user-facing disclosure, consent step, or data-classification guard before external transmission. This creates a real risk that task content, internal links, filenames, and generated outputs will be shared to third-party systems automatically, causing privacy leakage and unintended publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow describes automatic parallel tasking, Feishu notifications, result publication, and table updates as default behavior, again without warning the user about external sharing or verifying authorization for recipients and destinations. In this context, the automation makes the issue more dangerous because it scales disclosure across multiple subagents, users, documents, and records with little friction or review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description says this is a '完整部署技能' that helps users learn task decomposition and assignment, but it does not define when the skill should be invoked or what requests it should and should not handle. In a manifest file, this kind of broad capability description can overlap with many ordinary productivity requests and lead to unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The user-facing description and author fields are presented only in Chinese, with no indication that language is selectable or limited to a China-specific audience. For a general skill manifest, this can amount to a locale/language constraint that is not explicitly documented as opt-in or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file publishes operational identifiers for multiple Feishu bots, a group ID, and related workspace integration details in a broadly readable markdown config. Even if OpenID and group/base tokens are not equivalent to secrets by themselves, exposing them materially lowers the barrier for targeting, correlation, social engineering, and accidental misuse of workspace-integrated agents and resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructions explicitly tell operators to obtain an App ID and App Secret but provide no guidance on secure storage, non-commit policies, rotation, or least-privilege handling. This omission can lead users to place credentials into documentation, source control, or chat messages, creating a realistic path to credential leakage and compromise of the Feishu application.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill guidance is written entirely in Chinese and prescribes fixed Chinese completion templates and field labels, indicating the workflow expects a single language output. Because no user opt-in or locale justification is provided, this creates a natural-language locale policy concern under the requirement not to force a language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide requires agents to upload generated Markdown into Feishu cloud documents as part of the default workflow, but provides no data-classification, consent, or privacy checks before transmission. If the generated content contains user data, internal prompts, secrets, or regulated information, the agent could exfiltrate sensitive material to a third-party SaaS by design.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly instructs writing task metadata, OpenID/user identifiers, role information, and output links into Feishu documents and tables, but provides no minimization, consent, retention, or access-control guidance. This creates a real privacy and data-governance risk because operators may copy personal or sensitive work-product data into shared collaboration systems with overly broad visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These templates instruct agents to create Feishu documents and return local file paths and share links, but they provide no guidance on data classification, redaction, or access scope. In a multi-agent workflow, this can cause sensitive internal content, filesystem details, or unintentionally public links to be exposed to broader audiences than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The image collection template directs broad downloading from public sites and local saving, but it omits checks for license terms, provenance, and basic file safety. This creates risk of copyright misuse and unsafe ingestion of untrusted files or metadata into downstream workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The entire skill file is presented only in Chinese and gives no indication that users may choose another language or that the Chinese-only constraint is intentional for a region-specific purpose. Per SQP-3, a language/locale policy violation exists when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The required completion template instructs agents to include full local file paths in replies, which can reveal usernames, home directory structure, operating system details, project names, and other environment metadata. That information can aid fingerprinting, social engineering, or follow-on targeting even if it is not immediately critical.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The document prescribes task-tracking content, status messages, and communication templates entirely in Chinese, including the required completion reply format. There is no indication that users may choose another language or that the Chinese-only requirement is justified by a documented locale-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

All task and notification templates are presented only in Chinese, with no indication that users may choose another language or locale. Under the language/locale policy, forcing a single language without opt-in can be a policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.