Agent Feishu Doc

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:49 AM UTC
• Version: 1.0.0

Overview

The skill is disclosed as a Feishu document helper, but it normalizes public editable document links and global cross-agent session visibility without clear safeguards.

Review before installing. Use this only if you are comfortable with agents operating on Feishu documents, and do not follow the public-editable or global session-visibility steps unless an administrator explicitly approves them. Prefer private documents, named collaborators, least-privilege roles, and temporary or read-only sharing where possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:39
• Finding: Anonymous Public Edit Permissions Violate Least Privilege## Vulnerability Details **File Location**: `SKILL.md:39-49` **Additional Location**: `references/guide.md:86-96,103` **Vulnerability Type**: Overbroad anonymous document permissions **Risk Level**: High ### Vulnerable Code ```bash curl -X PATCH "https://open.feishu.cn/open-apis/drive/v1/permissions/{doc_id}/public?type=docx" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d '{ "link_share_entity": "anyone_editable", "external_access_entity": "anyone_can_edit", "security_entity": "anyone_can_edit", "comment_entity": "anyone_can_edit", "share_entity": "anyone" }' ``` The detailed guide also recommends making documents public immediately: ```text **Solution**: Set public permissions immediately after creation ``` ### Technical Analysis The Skill instructs agents to grant anonymous users edit, comment, sharing, security, and external-access capabilities. The detailed workflow presents this permission change as a routine step and recommends applying it immediately after document creation. Public anonymous editing is not required for the Skill's basic declared operations of creating, reading, or editing Feishu documents. Named collaborators, tenant-restricted sharing, or view-only links would provide narrower access. Applying anonymous edit permissions by default therefore violates least privilege. Anyone who obtains the document URL may be able to access and modify its contents without being individually authenticated or authorized as a collaborator. Document links can be exposed through chat history, forwarded messages, browser history, logs, or accidental sharing. ### Attack Path 1. A user asks an agent to create or populate a Feishu document. 2. The agent follows the Skill workflow and invokes the public-permission endpoint. 3. The document is configured so that anyone with access to the link can edit, comment, share, and potentially acc ...[truncated 917 chars]
• Remediation: ## Remediation Suggestions 1. Keep newly created documents private by default. 2. Add only explicitly named users, groups, or applications as collaborators. 3. Grant the minimum required role, preferring view-only or comment-only access over edit access. 4. Require explicit user confirmation before enabling any public-link permission. 5. Display a clear warning explaining that anonymous links may expose document contents outside the intended tenant or collaborator set. 6. Do not automatically change security, external-access, comment, and sharing permissions as part of ordinary document creation. 7. If public sharing is explicitly required, prefer an expiration-controlled, view-only link and provide instructions for revoking it. 8. Update both `SKILL.md` and `references/guide.md` so that public access is documented as an exceptional, user-authorized operation rather than the default workflow.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/guide.md:21
• Finding: Global Cross-Agent Session Visibility Breaks Agent Isolation## Vulnerability Details **File Location**: `references/guide.md:21-30` **Additional Location**: `SKILL.md:58,63` and `references/guide.md:116-117` **Vulnerability Type**: Overbroad cross-agent session access **Risk Level**: High ### Vulnerable Code ```markdown ### 2. Enable Cross-Agent Communication Add the following under `tools`: ```json "tools": { "sessions": { "visibility": "all" } } ``` Restart to apply: `openclaw gateway restart` ``` ### Technical Analysis The guide directs users to configure `tools.sessions.visibility` as `all`, globally widening session visibility to support cross-agent collaboration. The same recommendation is repeated as both a prerequisite and a troubleshooting solution. Global visibility is not required for creating, reading, editing, or sharing a Feishu document. It changes the broader OpenClaw access-control boundary rather than granting narrowly scoped access to a particular document or collaboration session. If an untrusted, misconfigured, or compromised agent can use the session tooling, global visibility may expose unrelated session context that was not intended to participate in the Feishu workflow. This weakens separation between agents and tasks and exceeds the minimum privileges needed by the Skill. ### Attack Path 1. A user encounters a cross-agent collaboration error while following the guide. 2. The user changes `tools.sessions.visibility` to `all` and restarts the gateway. 3. The configuration broadens session visibility beyond the specific agents or document involved in the task. 4. An untrusted or compromised agent uses the newly available session visibility to access unrelated session context, subject to the capabilities of the session tooling. 5. Information obtained from those sessions may be disclosed or used to influence subsequent tasks. ### Impact Assessment The affected privilege boundary is cross-agent session isolation. The sco ...[truncated 498 chars]
• Remediation: ## Remediation Suggestions 1. Do not recommend `tools.sessions.visibility: "all"` as a standard prerequisite or troubleshooting step. 2. Use per-agent, per-session, or explicit allowlist-based visibility where supported. 3. Limit collaboration to the specific agents and session required for the document workflow. 4. Prefer sharing the Feishu document with named application identities instead of broadening unrelated session access. 5. If global visibility is unavoidable, require informed administrator approval and document the resulting isolation risks. 6. Provide a rollback procedure that restores the previous visibility setting immediately after the collaboration task. 7. Audit which agents can invoke session tools before enabling broader visibility. 8. Update `SKILL.md` and `references/guide.md` to separate optional cross-agent configuration from the core Feishu document workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guide explicitly instructs agents to set Feishu documents to publicly editable by anyone, including external users, without any warning, approval gate, or discussion of confidentiality and integrity risks. In an agent skill context, this is especially dangerous because it operationalizes broad write access as a default workflow, making accidental data exposure and unauthorized tampering likely.

Credential Access

High

• Category: Privilege Escalation

Content

---

## 获取 Tenant Access Token

```bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Create Document
```bash
curl -X POST "https://open.feishu.cn/open-apis/drive/v1/documents" \
  -H "Authorization: Bearer {token}" \
  -H "Content-Type: application/json" \
  -d '{"title": "文档标题"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs setting Feishu documents to "anyone editable" and repeats this as a troubleshooting path without any warning, approval gate, or requirement to confirm that broad public write access is intended. This creates a real confidentiality and integrity risk: exposed documents can be discovered, modified, defaced, or used to leak sensitive information, and the collaboration-oriented context makes accidental overexposure more likely.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The permission example enables broad exposure by making documents publicly editable and externally accessible, which can leak sensitive content and allow unauthorized modifications. Because this skill is designed to automate document creation and sharing across agents, the insecure sharing pattern can be propagated repeatedly at scale.

Ssd 4

Medium

• Confidence: 91% confidence
• Finding: The workflow narrates creating a document, making it publicly editable, and distributing the link across multiple agents, normalizing an insecure collaboration pattern. While the issue is partly instructional rather than executable code, it still materially increases the chance of over-sharing, link sprawl, and unauthorized edits in real deployments.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 获取 Tenant Access Token

```bash
curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "cli_xxx", "app_secret": "xxx"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Natural-language policy violations include forcing a specific language without user opt-in. This guide is entirely in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Static analysis

No suspicious patterns detected.