Security audit

飞书 Agent 配置助手

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Feishu/OpenClaw configuration helper, but its generated defaults can expose secrets and allow overly broad bot access.

Review the generated configuration carefully before installing or using this skill. Avoid passing real App Secrets through shell history or CI logs, rotate any secret already exposed this way, replace allowFrom: ["*"] with a narrow allowlist where possible, and prefer restrictive DM policies for agents with tools, private context, or paid resources.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:66
Finding: Feishu App Secret Exposed Through Process Arguments and Terminal Output
Content: View full analysis
飞书应用的 App ID (必填)\n --app-secret 飞书应用的 App Secret (必填)\n --account-id 为该飞书账户生成一个自定义标识 (可选, 默认自动生成)\n --bot-name 机器人名称 (可选, 默认: "飞书机器人")\n --dm-policy DM 消息处理策略: open/pairing/allowlist (可选, 默认: open)\n --agent-id 要绑定的 Agent ID (可选)\n --chat-id 飞书群聊 ID (oc_xxx 格式), 在群聊绑定模式下必填\n --routing-mode 路由模式: account (账户级) / group (群聊级) (可选, 默认: account)\n --help 显示帮助信息\n`); ``` ### Technical Analysis The Feishu App Secret is accepted directly through `process.argv` and then printed in plaintext as part of the generated configuration fragment. Sensitive values passed on a command line may be exposed through: - Shell history files. - Process inspection utilities while the command is running. - Terminal scrollback and session recording. - CI/CD logs or automation output. - Support transcripts and copied configuration previews. Printing the complete secret creates an additional disclosure channel even when process arguments are otherwise protected. ### Attack Path 1. A user follows the documented usage and runs the helper with `--app-secret`. 2. The shell records the command, includ ...[truncated 931 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.js:61
Finding: Generated Configuration Enables Unrestricted Direct-Message Access by Default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:66
Finding: Unescaped User Input Allows Generated JSON Configuration Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code presents all user-facing messages, errors, help text, and examples exclusively in Chinese. That imposes a specific language on all users without offering a locale option or documenting a justified region-specific restriction, which matches the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file presents all user-facing instructions and behavior descriptions only in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or alternative language option is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language description is written only in Chinese and presents the skill purpose without offering a language choice or documenting that the skill is intended only for Chinese-speaking users. This may violate language/locale policy where user-facing skills should not force a specific language without opt-in or clear regional justification.
Content: No source excerpt is available for this finding.