飞书转发消息读取器

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:54 PM UTC
• Version: 1.1.0

Overview

The skill appears to perform its stated Feishu message-reading function, but it handles Feishu app secrets and sensitive message access in ways users should review carefully before installing.

Install only if you are comfortable giving this skill access to a Feishu app with message-read permissions. Prefer environment variables or a protected secret store over command-line secrets, avoid running it in shared or logged shells, use the narrowest Feishu app permissions possible, and retrieve forwarded messages only when you are authorized to view their contents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parse_forward.py:233
• Finding: Feishu Application Secret Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/parse_forward.py:233-234`; `scripts/read_forward.sh:8-12`; documented in `SKILL.md:31` and `SKILL.md:44` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/parse_forward.py:233-234`: ```python parser.add_argument('--app-id', help='飞书 App ID (或设置 FEISHU_APP_ID 环境变量)') parser.add_argument('--app-secret', help='飞书 App Secret (或设置 FEISHU_APP_SECRET 环境变量)') ``` `scripts/read_forward.sh:8-12`: ```bash # Usage: ./read_forward.sh <message_id> [app_id] [app_secret] MESSAGE_ID="$1" APP_ID="${2:-$FEISHU_APP_ID}" APP_SECRET="${3:-$FEISHU_APP_SECRET}" ``` `SKILL.md:31`: ```bash python3 scripts/parse_forward.py <message_id> --app-id <id> --app-secret <secret> ``` `SKILL.md:44`: ```bash ./scripts/read_forward.sh <message_id> <app_id> <app_secret> ``` ### Technical Analysis Both implementations accept the Feishu application secret directly through command-line arguments, and the documentation recommends this invocation method. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history and may be observable through process inspection, command auditing, CI/CD logs, terminal recording, or job orchestration metadata. The secret is subsequently exchanged with the official Feishu token endpoint for a tenant access token. The network exchange itself is necessary for the declared message-reading functionality and targets the documented Feishu domain; no unauthorized external recipient was identified. The vulnerability is the local exposure of the credential before or during that legitimate exchange. ### Attack Path 1. An operator follows the documented example and supplies the Feishu application secret in the command line. 2. The complete command is stored in shell history, captured by execution logs, or temporarily exposed through process metadata. 3. ...[truncated 1316 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--app-secret` and the shell script's positional secret argument so secrets cannot be supplied through process arguments. 2. Prefer a secret manager or a protected configuration file with restrictive permissions, such as mode `0600`, and validate ownership and permissions before reading it. 3. If interactive entry is required, use Python's `getpass.getpass()` so the secret is neither echoed nor embedded in command history. 4. Retain environment-variable support only where the execution environment injects variables securely; warn that inline assignments and CI logging can still disclose them. 5. Update all examples in `SKILL.md` to avoid placing secrets in commands. 6. Avoid including secrets or access tokens in errors, debug output, telemetry, or exception traces. 7. Rotate any Feishu application secret previously used through the documented command-line method and review shell histories and execution logs for exposure. 8. Apply the least Feishu permissions necessary. Keep contact lookup optional, default it off where sender names are unnecessary, and restrict the application's message visibility as narrowly as Feishu permits. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is reading forwarded-message contents, but the skill also retrieves credentials from environment variables, command-line arguments, and a local OpenClaw config file. That mismatch is dangerous because it hides sensitive-data access behind a seemingly narrow utility function, reducing informed consent and increasing the risk of credential exposure or overbroad execution.

Credential Access

High

• Category: Privilege Escalation

Content

-d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then
  echo "Error: Failed to get access token"
  exit 1
fi

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents shell, network, and environment-based behavior but does not declare any explicit tool scope or permissions boundaries. In a skill system, this omission is dangerous because it can cause users or orchestrators to invoke a capability that reads local secrets and makes outbound requests without a clear least-privilege contract.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs users to retrieve and display the full contents of forwarded Feishu messages, but it does not prominently warn that those messages may contain private or access-controlled content. This is dangerous because merged-forward messages often aggregate multiple users' messages, so expanding them can expose sensitive information beyond what the operator expects.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script automatically reads Feishu credentials not only from explicit CLI arguments but also from environment variables and a separate OpenClaw config file in the user's home directory. That broadens the skill's authority and can cause it to access organizational data using ambient credentials without a clear, per-use consent boundary, which is risky in an agent/skill context.

External Transmission

Medium

• Category: Data Exfiltration

Content

if cache_key in _token_cache:
        return _token_cache[cache_key]
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

if cache_key in _token_cache:
        return _token_cache[cache_key]
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tainted flow: 'token' from requests.post (line 76, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

def fetch_message(message_id: str, token: str) -> dict:
    """获取消息详情"""
    resp = requests.get(
        f'https://open.feishu.cn/open-apis/im/v1/messages/{message_id}',
        headers={'Authorization': f'Bearer {token}'}
    )

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'token' from requests.post (line 76, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

def get_user_name(open_id: str, token: str) -> str:
    """获取用户名（带缓存）"""
    try:
        resp = requests.get(
            f'https://open.feishu.cn/open-apis/contact/v3/users/{open_id}?user_id_type=open_id',
            headers={'Authorization': f'Bearer {token}'}
        )

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The manifest describes a skill for reading and parsing merged-forward Feishu message contents. While calling Feishu APIs is expected, this script also searches multiple credential sources, including process environment and a local user config file under ~/.openclaw, which is a broader capability than simply parsing forwarded messages and is not disclosed in the stated purpose.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 获取 tenant_access_token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 获取 tenant_access_token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends app_id and app_secret to Feishu's token endpoint and then queries a message API using the provided message ID. While comments indicate the technical purpose, there is no runtime disclosure that the script will contact remote Feishu APIs and transmit authentication material and message-related data.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: All user-facing natural-language instructions and examples are in Chinese, and the document does not indicate that the skill is region-specific or that another language can be used. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script fetches message contents and user profile information from remote Feishu endpoints using message IDs and access tokens, which involves transmitting identifiers and retrieving potentially sensitive communication data over the network. While this is part of the script's functionality, there is no explicit user-facing disclosure or warning in the CLI help or runtime output that it will contact external APIs and query user names.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This shell script reads FEISHU_APP_ID and FEISHU_APP_SECRET from environment variables and, if absent, falls back to ~/.openclaw/openclaw.json. Although comments describe the credential sources, there is no explicit user-facing warning or disclosure at runtime that sensitive credentials will be read from the environment or local configuration.

Static analysis

No suspicious patterns detected.