ClawHub
Back to skill

Security audit

Agent Feishu Doc

Security checks for vulnerabilities and agentic risk

Overview

The skill is disclosed as a Feishu document helper, but it normalizes public editable document links and global cross-agent session visibility without clear safeguards.

Review before installing. Use this only if you are comfortable with agents operating on Feishu documents, and do not follow the public-editable or global session-visibility steps unless an administrator explicitly approves them. Prefer private documents, named collaborators, least-privilege roles, and temporary or read-only sharing where possible.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:39
Finding

Anonymous Public Edit Permissions Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39-49
Additional Location: references/guide.md:86-96,103
Vulnerability Type: Overbroad anonymous document permissions
Risk Level: High

Vulnerable Code

bash
curl -X PATCH "https://open.feishu.cn/open-apis/drive/v1/permissions/{doc_id}/public?type=docx" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{
    "link_share_entity": "anyone_editable",
    "external_access_entity": "anyone_can_edit",
    "security_entity": "anyone_can_edit",
    "comment_entity": "anyone_can_edit",
    "share_entity": "anyone"
  }'

The detailed guide also recommends making documents public immediately:

text
**Solution**: Set public permissions immediately after creation

Technical Analysis

The Skill instructs agents to grant anonymous users edit, comment, sharing, security, and external-access capabilities. The detailed workflow presents this permission change as a routine step and recommends applying it immediately after document creation.

Public anonymous editing is not required for the Skill's basic declared operations of creating, reading, or editing Feishu documents. Named collaborators, tenant-restricted sharing, or view-only links would provide narrower access. Applying anonymous edit permissions by default therefore violates least privilege.

Anyone who obtains the document URL may be able to access and modify its contents without being individually authenticated or authorized as a collaborator. Document links can be exposed through chat history, forwarded messages, browser history, logs, or accidental sharing.

Attack Path

  1. A user asks an agent to create or populate a Feishu document.
  2. The agent follows the Skill workflow and invokes the public-permission endpoint.
  3. The document is configured so that anyone with access to the link can edit, comment, share, and potentially acc ...[truncated 917 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep newly created documents private by default.
  2. Add only explicitly named users, groups, or applications as collaborators.
  3. Grant the minimum required role, preferring view-only or comment-only access over edit access.
  4. Require explicit user confirmation before enabling any public-link permission.
  5. Display a clear warning explaining that anonymous links may expose document contents outside the intended tenant or collaborator set.
  6. Do not automatically change security, external-access, comment, and sharing permissions as part of ordinary document creation.
  7. If public sharing is explicitly required, prefer an expiration-controlled, view-only link and provide instructions for revoking it.
  8. Update both SKILL.md and references/guide.md so that public access is documented as an exceptional, user-authorized operation rather than the default workflow.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/guide.md:21
Finding

Global Cross-Agent Session Visibility Breaks Agent Isolation

Content
View full analysis

Vulnerability Details

File Location: references/guide.md:21-30
Additional Location: SKILL.md:58,63 and references/guide.md:116-117
Vulnerability Type: Overbroad cross-agent session access
Risk Level: High

Vulnerable Code

markdown
### 2. Enable Cross-Agent Communication

Add the following under `tools`:

```json
"tools": {
  "sessions": {
    "visibility": "all"
  }
}

Restart to apply: openclaw gateway restart

text

### Technical Analysis

The guide directs users to configure `tools.sessions.visibility` as `all`, globally widening session visibility to support cross-agent collaboration. The same recommendation is repeated as both a prerequisite and a troubleshooting solution.

Global visibility is not required for creating, reading, editing, or sharing a Feishu document. It changes the broader OpenClaw access-control boundary rather than granting narrowly scoped access to a particular document or collaboration session.

If an untrusted, misconfigured, or compromised agent can use the session tooling, global visibility may expose unrelated session context that was not intended to participate in the Feishu workflow. This weakens separation between agents and tasks and exceeds the minimum privileges needed by the Skill.

### Attack Path

1. A user encounters a cross-agent collaboration error while following the guide.
2. The user changes `tools.sessions.visibility` to `all` and restarts the gateway.
3. The configuration broadens session visibility beyond the specific agents or document involved in the task.
4. An untrusted or compromised agent uses the newly available session visibility to access unrelated session context, subject to the capabilities of the session tooling.
5. Information obtained from those sessions may be disclosed or used to influence subsequent tasks.

### Impact Assessment

The affected privilege boundary is cross-agent session isolation. The sco
...[truncated 498 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend tools.sessions.visibility: "all" as a standard prerequisite or troubleshooting step.
  2. Use per-agent, per-session, or explicit allowlist-based visibility where supported.
  3. Limit collaboration to the specific agents and session required for the document workflow.
  4. Prefer sharing the Feishu document with named application identities instead of broadening unrelated session access.
  5. If global visibility is unavoidable, require informed administrator approval and document the resulting isolation risks.
  6. Provide a rollback procedure that restores the previous visibility setting immediately after the collaboration task.
  7. Audit which agents can invoke session tools before enabling broader visibility.
  8. Update SKILL.md and references/guide.md to separate optional cross-agent configuration from the core Feishu document workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide explicitly instructs agents to set Feishu documents to publicly editable by anyone, including external users, without any warning, approval gate, or discussion of confidentiality and integrity risks. In an agent skill context, this is especially dangerous because it operationalizes broad write access as a default workflow, making accidental data exposure and unauthorized tampering likely.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/guide.md (reported line 133)May include surrounding context.

获取 Tenant Access Token

bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

1. Create Document

bash
curl -X POST "https://open.feishu.cn/open-apis/drive/v1/documents" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"title": "文档标题"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs setting Feishu documents to "anyone editable" and repeats this as a troubleshooting path without any warning, approval gate, or requirement to confirm that broad public write access is intended. This creates a real confidentiality and integrity risk: exposed documents can be discovered, modified, defaced, or used to leak sensitive information, and the collaboration-oriented context makes accidental overexposure more likely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The permission example enables broad exposure by making documents publicly editable and externally accessible, which can leak sensitive content and allow unauthorized modifications. Because this skill is designed to automate document creation and sharing across agents, the insecure sharing pattern can be propagated repeatedly at scale.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow narrates creating a document, making it publicly editable, and distributing the link across multiple agents, normalizing an insecure collaboration pattern. While the issue is partly instructional rather than executable code, it still materially increases the chance of over-sharing, link sprawl, and unauthorized edits in real deployments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/guide.md (reported line 136)May include surrounding context.

获取 Tenant Access Token

bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Natural-language policy violations include forcing a specific language without user opt-in. This guide is entirely in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.