ClawHub
Back to skill

Security audit

Feishu Messaging

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Feishu messaging helper, but it under-discloses file upload and organizational metadata handling while encouraging verbose logging of sensitive API responses.

Review before installing or using in a tenant environment. Limit the Feishu app to the minimum permissions needed, avoid copying the DEBUG logging and full-response logging patterns, confirm recipients and file paths before sending, and treat chat/member lookup results and uploaded files as sensitive organizational data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:47
Finding

Potential Exposure of Sensitive Feishu API Data Through Verbose Logging

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47, 64-68, 89, 110-114, 136, 155-159, 181, 202-206, 228, and 244-248
Vulnerability Type: Sensitive data exposure through debug and unrestricted response logging
Risk Level: Medium

Vulnerable Code

The examples enable SDK debug logging in every API client:

python
.log_level(lark.LogLevel.DEBUG) \

Failed API responses are written to logs without redaction:

python
lark.logger.error(
    f"client.im.v1.chat.search failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")

Complete successful API response objects are also logged:

python
lark.logger.info(lark.JSON.marshal(response.data, indent=4))

Equivalent logging patterns are repeated in the message creation, image upload, file upload, and group-member retrieval examples.

Technical Analysis

The Skill instructs users to enable the Feishu SDK's DEBUG log level while also explicitly logging complete successful and failed API responses. These responses can contain user identifiers, chat identifiers, member records, message metadata, uploaded-file metadata, diagnostic details, and other tenant-specific information.

Debug-level SDK output may additionally expose HTTP request or response details beyond those explicitly logged by the examples. Because the response content is serialized without field filtering or redaction, any sensitive values returned by the API can be copied into terminal output, CI logs, agent transcripts, or centralized logging platforms.

Exploitation requires access to logs generated by an authenticated execution. This issue does not independently grant additional Feishu privileges; it exposes information already available to the configured application and returned by the invoked API.

Attack Path

  1. A user copies or executes on ...[truncated 1301 chars]
Remediation
View remediation

Remediation Suggestions

  1. Change the default SDK log level from DEBUG to INFO, WARNING, or ERROR.
  2. Permit debug logging only through an explicit, temporary troubleshooting option that is disabled by default.
  3. Do not log response.raw.content or serialize complete response.data objects.
  4. Log only the minimum operational fields required, such as the API operation, result status, error code, and request or log identifier.
  5. Apply centralized redaction for user IDs, chat IDs, message content, file metadata, authorization headers, tokens, and tenant-specific fields.
  6. Restrict access to application and CI logs, define short retention periods, and prevent logs from being included in public build artifacts or agent transcripts.
  7. Add tests or linting rules that detect debug logging and unrestricted serialization of API responses.
  8. Replace the fixed example user and chat identifiers with clearly marked placeholders to reduce the chance of accidental operations against unintended resources.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest and overview position the skill as Feishu message sending and document creation, but the content also documents broader resource management capabilities such as image/file upload and chat/member enumeration. This scope mismatch can mislead reviewers and users about what the skill can do, reducing informed consent and increasing the chance that higher-risk capabilities are approved or invoked without proper scrutiny.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest claims a document-creation workflow, but the file provides no implementation or instructions for document creation. While not directly exploitable code, this inaccurate capability declaration undermines trust in the skill definition and can interfere with security review by obscuring what is actually implemented versus what is only claimed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill describes querying group members and chat information without warning that these operations access potentially sensitive organizational metadata such as chat IDs, member identities, and group structure. In enterprise environments, that metadata can aid reconnaissance, targeted messaging, or privacy violations if exposed or used without clear authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents sending messages and uploading files/images to an external platform without warning that user-provided content and local files will be transmitted to Feishu. This is dangerous because users may unknowingly disclose sensitive text, media, or attachments to third-party infrastructure under organizational credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes image and file upload workflows that are broader than the stated message-sending purpose, enabling transmission of arbitrary local content to Feishu. In this context, undocumented upload capability increases the risk of unintended data exfiltration, especially because users or operators may approve the skill expecting only text messaging behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.