飞书 Agent 配置助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 0.1.0

Overview

The skill appears to be a real Feishu/OpenClaw configuration helper, but its generated defaults can expose secrets and allow overly broad bot access.

Review the generated configuration carefully before installing or using this skill. Avoid passing real App Secrets through shell history or CI logs, rotate any secret already exposed this way, replace allowFrom: ["*"] with a narrow allowlist where possible, and prefer restrictive DM policies for agents with tools, private context, or paid resources.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:66
• Finding: Feishu App Secret Exposed Through Process Arguments and Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `index.js:66-75` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```js console.log(`\n${colors.bold}--- 飞书机器人配置片段 ---${colors.reset}`); console.log(`${colors.cyan}将以下内容添加到您的 ~/.openclaw/openclaw.json 文件中相应位置。${colors.reset}`); log.step(1, 3, `在 "channels": {"feishu": {"accounts": {}}} 中添加账户配置`); console.log(`\`\`\`json "${generatedAccountId}": { "appId": "${appid}", "appSecret": "${appsecret}", "botName": "${resolvedBotName}", "dmPolicy": "${resolvedDmPolicy}", "allowFrom": ["*"], "enabled": true }\`\`\``); ``` The CLI also instructs users to pass the secret as a command-line argument: ```js console.log(`${colors.bold}选项:${colors.reset}\n --app-id <id> 飞书应用的 App ID (必填)\n --app-secret <secret> 飞书应用的 App Secret (必填)\n --account-id <id> 为该飞书账户生成一个自定义标识 (可选, 默认自动生成)\n --bot-name <name> 机器人名称 (可选, 默认: "飞书机器人")\n --dm-policy <policy> DM 消息处理策略: open/pairing/allowlist (可选, 默认: open)\n --agent-id <id> 要绑定的 Agent ID (可选)\n --chat-id <id> 飞书群聊 ID (oc_xxx 格式), 在群聊绑定模式下必填\n --routing-mode <mode> 路由模式: account (账户级) / group (群聊级) (可选, 默认: account)\n --help 显示帮助信息\n`); ``` ### Technical Analysis The Feishu App Secret is accepted directly through `process.argv` and then printed in plaintext as part of the generated configuration fragment. Sensitive values passed on a command line may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Terminal scrollback and session recording. - CI/CD logs or automation output. - Support transcripts and copied configuration previews. Printing the complete secret creates an additional disclosure channel even when process arguments are otherwise protected. ### Attack Path 1. A user follows the documented usage and runs the helper with `--app-secret`. 2. The shell records the command, includ ...[truncated 931 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not require secrets to be supplied directly as command-line arguments. - Read the App Secret through a masked interactive prompt, standard input, a protected file descriptor, or a dedicated secret manager. - If environment-variable input is supported, document that environment exposure must be controlled and avoid logging the environment. - Redact the secret in previews, showing only a short suffix if confirmation is necessary. - Provide an option to write the configuration directly to a securely permissioned file without echoing the secret. - Ensure any generated file containing credentials is created with restrictive permissions, such as owner read/write only. - Add automated tests that verify secrets never appear in stdout, stderr, error messages, or debug logs. - Warn users to rotate credentials if they have already passed them through recorded shells or CI systems. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:61
• Finding: Generated Configuration Enables Unrestricted Direct-Message Access by Default<![CDATA[ ## Vulnerability Details **File Location**: `index.js:61-74` **Vulnerability Type**: Insecure access-control defaults **Risk Level**: High ### Vulnerable Code ```js const generatedAccountId = accountid || `bot-${Math.random().toString(36).substring(2, 9)}`; const resolvedBotName = botname || '飞书机器人'; const resolvedDmPolicy = dmpolicy || 'open'; const resolvedRoutingMode = routingmode || 'account'; console.log(`\n${colors.bold}--- 飞书机器人配置片段 ---${colors.reset}`); console.log(`${colors.cyan}将以下内容添加到您的 ~/.openclaw/openclaw.json 文件中相应位置。${colors.reset}`); log.step(1, 3, `在 "channels": {"feishu": {"accounts": {}}} 中添加账户配置`); console.log(`\`\`\`json "${generatedAccountId}": { "appId": "${appid}", "appSecret": "${appsecret}", "botName": "${resolvedBotName}", "dmPolicy": "${resolvedDmPolicy}", "allowFrom": ["*"], "enabled": true }\`\`\``); ``` ### Technical Analysis When the user does not supply a direct-message policy, the helper selects `open`. Independently of the selected policy, the emitted configuration always contains: ```json "allowFrom": ["*"] ``` This configuration grants access to every sender rather than following least-privilege principles. When combined with the default account-level routing mode, arbitrary messages received by the Feishu account may be routed to the configured Agent. The security impact depends on the Agent's capabilities. An Agent that can access files, internal APIs, tools, confidential context, or paid resources exposes a larger attack surface than a conversational Agent with no privileged tools. ### Attack Path 1. An administrator runs the helper without explicitly selecting a restrictive DM policy. 2. The helper generates a configuration using `dmPolicy: "open"` and `allowFrom: ["*"]`. 3. The administrator copies the generated fragment into `openclaw.json` and restarts the Gateway as instructed. 4. An untrusted Feishu user sends a direct message to the bot. 5. OpenClaw accepts the mes ...[truncated 921 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Change the default DM policy from `open` to `pairing` or `allowlist`. - Do not emit `allowFrom: ["*"]` unless the user explicitly requests public access. - Require users to provide trusted sender or tenant identifiers when using an allowlist. - Display a prominent warning and require explicit confirmation before generating unrestricted access. - Validate `--dm-policy` against a strict enumeration and reject unknown values. - Where possible, scope access by account, tenant, group, and sender rather than using a global wildcard. - Recommend that privileged Agents implement authorization independently of channel-level routing. - Add tests confirming that the default configuration denies unknown senders. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:66
• Finding: Unescaped User Input Allows Generated JSON Configuration Injection<![CDATA[ ## Vulnerability Details **File Location**: `index.js:66-99` **Vulnerability Type**: JSON configuration injection **Risk Level**: Medium ### Vulnerable Code ```js console.log(`\n${colors.bold}--- 飞书机器人配置片段 ---${colors.reset}`); console.log(`${colors.cyan}将以下内容添加到您的 ~/.openclaw/openclaw.json 文件中相应位置。${colors.reset}`); log.step(1, 3, `在 "channels": {"feishu": {"accounts": {}}} 中添加账户配置`); console.log(`\`\`\`json "${generatedAccountId}": { "appId": "${appid}", "appSecret": "${appsecret}", "botName": "${resolvedBotName}", "dmPolicy": "${resolvedDmPolicy}", "allowFrom": ["*"], "enabled": true }\`\`\``); if (agentid) { log.step(2, 3, `在 "bindings": [] 中添加 Agent 绑定配置`); if (resolvedRoutingMode === 'account') { console.log(`\`\`\`json { "agentId": "${agentid}", "match": { "channel": "feishu", "accountId": "${generatedAccountId}" } }\`\`\``); log.info(`提示: 此为账户级绑定，该飞书账户的所有消息都将路由到 Agent "${agentid}"。`); } else if (resolvedRoutingMode === 'group' && chatid) { console.log(`\`\`\`json { "agentId": "${agentid}", "match": { "channel": "feishu", "peer": { "kind": "group", "id": "${chatid}" } } }\`\`\``); ``` ### Technical Analysis Values controlled through command-line arguments are inserted directly into JSON text using template interpolation. The code does not apply JSON escaping or construct an object through a JSON serializer. A value containing quotation marks, backslashes, line breaks, commas, or braces can therefore: - Produce invalid JSON. - Terminate the intended string value. - Insert additional properties or objects. - Alter routing or access-control configuration if the generated fragment is trusted and pasted without careful review. Affected values include the application ID, application secret, account ID, bot name, DM policy, Agent ID, and chat ID. The absence of strict enumeration validation for policy and routing-related values further weake ...[truncated 1535 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Construct ordinary JavaScript objects and serialize them with `JSON.stringify(object, null, 2)` rather than manually assembling JSON. - Apply strict validation to all identifiers before serialization. - Validate `--dm-policy` against only `open`, `pairing`, and `allowlist`. - Validate `--routing-mode` against only `account` and `group`, rejecting every other value. - Validate App IDs, account IDs, Agent IDs, and chat IDs against documented length and character constraints. - Treat App Secrets as opaque strings and rely on `JSON.stringify` for correct escaping. - Reject control characters where they are not expected. - Add tests using quotation marks, backslashes, Unicode characters, line breaks, commas, and braces in every input field. - Clearly label generated content as a preview and encourage review before it is merged into production configuration. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code presents all user-facing messages, errors, help text, and examples exclusively in Chinese. That imposes a specific language on all users without offering a locale option or documenting a justified region-specific restriction, which matches the natural-language policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The file presents all user-facing instructions and behavior descriptions only in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative language option is provided.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language description is written only in Chinese and presents the skill purpose without offering a language choice or documenting that the skill is intended only for Chinese-speaking users. This may violate language/locale policy where user-facing skills should not force a specific language without opt-in or clear regional justification.

Static analysis

No suspicious patterns detected.