飞书转发消息读取器

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:54 PM UTC
• Version: 1.1.0

Overview

The skill appears to perform its stated Feishu message-reading function, but it handles Feishu app secrets and sensitive message access in ways users should review carefully before installing.

Install only if you are comfortable giving this skill access to a Feishu app with message-read permissions. Prefer environment variables or a protected secret store over command-line secrets, avoid running it in shared or logged shells, use the narrowest Feishu app permissions possible, and retrieve forwarded messages only when you are authorized to view their contents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parse_forward.py:233

Finding

Feishu Application Secret Exposed Through Command-Line Arguments

Content

View full analysis

[app_id] [app_secret] MESSAGE_ID="$1" APP_ID="${2:-$FEISHU_APP_ID}" APP_SECRET="${3:-$FEISHU_APP_SECRET}" ``` `SKILL.md:31`: ```bash python3 scripts/parse_forward.py --app-id --app-secret ``` `SKILL.md:44`: ```bash ./scripts/read_forward.sh ``` ### Technical Analysis Both implementations accept the Feishu application secret directly through command-line arguments, and the documentation recommends this invocation method. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history and may be observable through process inspection, command auditing, CI/CD logs, terminal recording, or job orchestration metadata. The secret is subsequently exchanged with the official Feishu token endpoint for a tenant access token. The network exchange itself is necessary for the declared message-reading functionality and targets the documented Feishu domain; no unauthorized external recipient was identified. The vulnerability is the local exposure of the credential before or during that legitimate exchange. ### Attack Path 1. An operator follows the documented example and supplies the Feishu application secret in the command line. 2. The complete command is stored in shell history, captured by execution logs, or temporarily exposed through process metadata. 3. ...[truncated 1316 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose is reading forwarded-message contents, but the skill also retrieves credentials from environment variables, command-line arguments, and a local OpenClaw config file. That mismatch is dangerous because it hides sensitive-data access behind a seemingly narrow utility function, reducing informed consent and increasing the risk of credential exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/read_forward.sh (reported line 46)May include surrounding context.

sh

-d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
  echo "Error: Failed to get access token"
  exit 1
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents shell, network, and environment-based behavior but does not declare any explicit tool scope or permissions boundaries. In a skill system, this omission is dangerous because it can cause users or orchestrators to invoke a capability that reads local secrets and makes outbound requests without a clear least-privilege contract.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to retrieve and display the full contents of forwarded Feishu messages, but it does not prominently warn that those messages may contain private or access-controlled content. This is dangerous because merged-forward messages often aggregate multiple users' messages, so expanding them can expose sensitive information beyond what the operator expects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script automatically reads Feishu credentials not only from explicit CLI arguments but also from environment variables and a separate OpenClaw config file in the user's home directory. That broadens the skill's authority and can cause it to access organizational data using ambient credentials without a clear, per-use consent boundary, which is risky in an agent/skill context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_forward.py (reported line 69)May include surrounding context.

python

if cache_key in _token_cache:
        return _token_cache[cache_key]
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/parse_forward.py (reported line 69)May include surrounding context.

python

if cache_key in _token_cache:
        return _token_cache[cache_key]
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

Tainted flow: 'token' from requests.post (line 76, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/parse_forward.py (reported line 83)May include surrounding context.

python

def fetch_message(message_id: str, token: str) -> dict:
    """获取消息详情"""
    resp = requests.get(
        f'https://open.feishu.cn/open-apis/im/v1/messages/{message_id}',
        headers={'Authorization': f'Bearer {token}'}
    )

Tainted flow: 'token' from requests.post (line 76, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/parse_forward.py (reported line 94)May include surrounding context.

python

def get_user_name(open_id: str, token: str) -> str:
    """获取用户名（带缓存）"""
    try:
        resp = requests.get(
            f'https://open.feishu.cn/open-apis/contact/v3/users/{open_id}?user_id_type=open_id',
            headers={'Authorization': f'Bearer {token}'}
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a skill for reading and parsing merged-forward Feishu message contents. While calling Feishu APIs is expected, this script also searches multiple credential sources, including process environment and a local user config file under ~/.openclaw, which is a broader capability than simply parsing forwarded messages and is not disclosed in the stated purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

fi

# 获取 tenant_access_token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/read_forward.sh (reported line 41)May include surrounding context.

sh

fi

# 获取 tenant_access_token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends app_id and app_secret to Feishu's token endpoint and then queries a message API using the provided message ID. While comments indicate the technical purpose, there is no runtime disclosure that the script will contact remote Feishu APIs and transmit authentication material and message-related data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

All user-facing natural-language instructions and examples are in Chinese, and the document does not indicate that the skill is region-specific or that another language can be used. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script fetches message contents and user profile information from remote Feishu endpoints using message IDs and access tokens, which involves transmitting identifiers and retrieving potentially sensitive communication data over the network. While this is part of the script's functionality, there is no explicit user-facing disclosure or warning in the CLI help or runtime output that it will contact external APIs and query user names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This shell script reads FEISHU_APP_ID and FEISHU_APP_SECRET from environment variables and, if absent, falls back to ~/.openclaw/openclaw.json. Although comments describe the credential sources, there is no explicit user-facing warning or disclosure at runtime that sensitive credentials will be read from the environment or local configuration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.