ClawHub
Back to skill

Security audit

feishu-card-sender-beautify 飞书推送展示卡片脚本

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a straightforward Feishu card-sending helper, but it asks users to grant inbound message access and has broad send triggers without clear confirmation or recipient controls.

Install only if you intend the agent to send Feishu messages. Before use, restrict the Feishu app to the minimum send permission, avoid granting inbound message access unless separately required, and require explicit recipient IDs and confirmation before sending sensitive or broad-audience notifications.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
references/api-guide.md:73
Finding

Unnecessary inbound-message permission violates least privilege

Content
View full analysis

Vulnerability Details

File Location: references/api-guide.md, lines 73–77
Vulnerability Type: Excessive application permissions
Risk Level: Low

Vulnerable Code Snippet

markdown
## 权限要求

发送消息需要飞书应用具备以下权限：
- `im.message.send_as_bot` - 发送消息
- `im.message.receive_as_bot` - 接收消息

Technical Analysis

The skill's documented purpose and behavior are limited to constructing and sending Feishu Interactive Cards. The im.message.send_as_bot permission is consistent with that purpose, but the guide also identifies im.message.receive_as_bot as required.

Inbound-message access is not necessary for the documented outbound-only functionality. Requesting it expands the application's authorization scope beyond the minimum privileges required for the task. Although the repository contains no code that directly abuses this permission, following the setup instructions would unnecessarily expose incoming message data to the associated Feishu application.

Attack Path

  1. An administrator follows the skill's API setup guide.
  2. The administrator grants both the send and receive permissions to the Feishu application.
  3. The application obtains access to incoming messages despite the skill only requiring outbound delivery.
  4. If the application, its event-processing environment, or its credentials are later compromised, an attacker may use the excessive permission to access incoming conversation content available to the application.

Impact Assessment

The excessive permission broadens the application's data-access scope to inbound Feishu messages. The practical exposure depends on Feishu tenant configuration, event subscriptions, application installation scope, and platform enforcement. It does not itself grant code execution, persistence, or administrative privileges, but it increases the confidentiality impact of a compromised or misconfigured application.

Remediation
View remediation

Remediation Suggestions

  • Remove im.message.receive_as_bot from the documented required permissions when the skill is used solely to send cards.
  • Document im.message.send_as_bot as the minimum permission for outbound delivery.
  • If inbound access is required by an undocumented feature or platform constraint, explain that dependency explicitly and separate it from the basic sending setup.
  • Restrict event subscriptions, application installation scope, and message processing to the minimum required chats and event types.
  • Periodically review granted Feishu permissions and revoke permissions not actively used.
  • Avoid logging incoming message content unless necessary, and apply appropriate retention and access controls where processing is required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad and loosely defined, especially phrases like '格式化通知需求' and scheduled push scenarios, which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs an external side effect by sending Feishu messages, ambiguous invocation increases the risk of unintended message delivery, notification spam, or disclosure of content to the wrong recipient/chat.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The metadata description is broad and does not clearly constrain when the skill should activate or what inputs it is allowed to process. In an agent environment, ambiguous activation language can cause over-triggering or invocation in unintended contexts, which may lead to unauthorized message sending, notification misuse, or accidental data disclosure through outbound Feishu card messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The API guide documents outbound message-sending to Feishu but does not warn that message content and recipient identifiers are transmitted to an external platform. In a notification-sending skill, this omission can cause operators or downstream agents to send sensitive data without explicit user awareness or policy checks, creating a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains only Chinese-language headings, labels, and examples, with no note that the skill supports multiple languages or that Chinese is an explicit user-selected locale. Under the policy rule for language/locale constraints, forcing a single language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.