Feishu Send Message as App

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for sending Feishu bot messages, but it needs review because it handles app credentials and has real unsafe credential-loading and token-cache behavior.

Review before installing. Use only with a Feishu app whose permissions are limited to the intended messaging scope, run it as an unprivileged user, verify recipient IDs and message content before sending, and patch the script to pass OPENCLAW_JSON as an argument plus store any token cache in a private chmod 600 user directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send-message.sh:9

Finding

Arbitrary Python Code Execution Through OPENCLAW_JSON

Content

View full analysis

Remediation

View remediation

&2 return 1 ;; esac python3 - "$OPENCLAW_JSON" "$1" <<'PY' import json import sys config_path = sys.argv[1] credential_key = sys.argv[2] with open(config_path, encoding="utf-8") as config_file: data = json.load(config_file) print(data["channels"]["feishu"][credential_key]) PY } ``` Additional hardening should include: 1. Validate that the configuration path is absolute and points to an expected configuration directory. 2. Reject symbolic links if the configuration location must be trusted. 3. Verify file ownership and permissions before reading secrets. 4. Run the Skill under a dedicated, unprivileged account rather than `root`. 5. Restrict which environment variables untrusted callers can supply. 6. Keep the explicit allowlist for credential keys so future callers cannot request arbitrary configuration fields. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send-message.sh:18

Finding

Feishu Bearer Token Stored in an Unsafe Predictable Temporary File

Content

View full analysis

/dev/null) local TOKEN=$(cat "$TOKEN_CACHE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('token',''))" 2>/dev/null) if [ -n "$TOKEN" ] && [ "$NOW" -lt "$((EXPIRES_AT - 300))" ]; then echo "$TOKEN" return 0 fi fi local RESP=$(curl -s -X POST "$API_BASE/auth/v3/app_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}") local TOKEN=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('app_access_token',''))" 2>/dev/null) local EXPIRES_IN=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin).get('expire',7200))" 2>/dev/null) if [ -z "$TOKEN" ]; then echo "Failed to get App Token: $RESP" >&2 return 1 fi echo "{\"token\":\"$TOKEN\",\"expires_at\":$((NOW + EXPIRES_IN - 300))}" > "$TOKEN_CACHE" echo "$TOKEN" } ``` ### Technical Analysis The Feishu app access token is written in plaintext to the fixed path `/tmp/feishu_app_token.cache`. The global temporary directory is shared between users, and the cache implementation does not: - Set a restrictive file-creation mask. - Create a private cache directory. - Verify file ownership. - Reject symbolic links. - Create or replace the cache atomically. - Lock the file against concurrent access. The resulting permissions depend on the caller's existing `umask`. With a common `022` m ...[truncated 2237 chars]

Remediation

View remediation

"$TEMP_CACHE" mv -f -- "$TEMP_CACHE" "$TOKEN_CACHE" ``` Further hardening should include: 1. Verify that the cache directory and existing cache file are owned by the current effective user. 2. Reject symbolic links using appropriate filesystem checks or descriptor-based APIs. 3. Use file locking when concurrent Skill invocations are possible. 4. Avoid caching the token entirely if request frequency does not require it. 5. Prefer an operating-system credential store or secret service where available. 6. Run the Skill as a dedicated unprivileged account. 7. Limit the Feishu app to only the API permissions required to send the intended messages. 8. Remove stale cache files when execution terminates or credentials are rotated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: feishu-send-message-as-app
description: "Send a Feishu IM message as the app (bot identity). Use when you need to send a message that appears to come from the bot/app, not the user. Uses App Access Token (no user auth needed). Supports text, image, post, card, and other Feishu msg types."
---

# Feishu Send Message as App

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/send-message.sh (reported line 44)May include surrounding context.

sh

fi
    fi
    
    local RESP=$(curl -s -X POST "$API_BASE/auth/v3/app_access_token/internal" \
        -H "Content-Type: application/json" \
        -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell scripts but does not declare any explicit tool scope or permission boundary. This weakens reviewability and can allow broader-than-expected command execution when the skill is installed or used, especially in environments that rely on metadata to constrain capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents a capability that can communicate outward to Feishu recipients, which can affect external users and system reputation. Although it states the message is sent as the app/bot, it does not include any caution or warning to verify recipient, content, or authorization before sending, so the behavior's impact is not clearly disclosed as a safety warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script reads Feishu app credentials from a local config file and then uses them to request an access token from a remote API. While there are internal comments, there is no user-facing prompt, warning, or disclosure that sensitive credentials will be accessed and used over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send-message.sh (reported line 44)May include surrounding context.

sh

fi
    fi
    
    local RESP=$(curl -s -X POST "$API_BASE/auth/v3/app_access_token/internal" \
        -H "Content-Type: application/json" \
        -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script sends authentication data to Feishu and later transmits the provided message payload to the Feishu messaging API. Although sending messages is the script's purpose, there is no explicit user-facing disclosure in the script that supplied content and identifiers will be sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes the bearer token to /tmp/feishu_app_token.cache without setting restrictive permissions or using a safer per-user location. On multi-user systems or hostile local environments, another local process may read or replace the cache file, leading to token theft or misuse of the bot identity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.