ClawHub
Back to skill

Security audit

Feishu Send File 1.2.1

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to send Feishu/Lark files and images as advertised, but it asks users to pass app secrets on the command line where they may be exposed locally.

Review before installing. Use only with a Feishu/Lark app whose permissions are limited to the needed messaging/upload scopes, and avoid typing real app secrets directly into command examples or automation logs. Prefer changing the scripts to read the secret from a protected environment variable, secret manager, or interactive hidden prompt before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_file.py:139
Finding

Application Secrets Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/send_file.py:139-151
  • scripts/send_image.py:139-150
  • SKILL.md:51-67
  • SKILL.md:72-85

Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

scripts/send_file.py:

python
file_path = sys.argv[1]
receive_id_type = sys.argv[2]
receive_id = sys.argv[3]
app_id = sys.argv[4]
app_secret = sys.argv[5]
file_name = sys.argv[6] if len(sys.argv) > 6 else os.path.basename(file_path)
domain = sys.argv[7] if len(sys.argv) > 7 else "feishu"

scripts/send_image.py:

python
image_path = sys.argv[1]
receive_id_type = sys.argv[2]
receive_id = sys.argv[3]
app_id = sys.argv[4]
app_secret = sys.argv[5]
domain = sys.argv[6] if len(sys.argv) > 6 else "feishu"

The documented invocation pattern also instructs users to supply the secret directly:

text
python3 scripts/send_file.py file_path receive_id_type receive_id app_id app_secret
python3 scripts/send_image.py image_path receive_id_type receive_id app_id app_secret

Technical Analysis

Both scripts accept the Feishu or Lark application secret as a positional command-line argument. Command-line arguments are commonly exposed through operating-system process inspection interfaces and process-monitoring utilities. Depending on the operating system and local security configuration, other users or services may be able to inspect the argument list while the script is running.

Interactive use may also store the complete command, including the application secret, in shell history. Terminal logging, automation logs, job definitions, diagnostic reports, and monitoring products may retain the same value.

The scripts send the supplied credentials over HTTPS only to allowlisted official Feishu or Lark authentication endpoints. The subsequent file and image uploads are consistent with the Skill's declared purpose. No arbitrary network destination or intentio ...[truncated 1540 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove app_secret from positional command-line arguments in both scripts.
  2. Read the secret from a protected secret manager, credential helper, or environment variable supplied by a secure execution environment.
  3. For interactive invocation, use getpass.getpass() so the secret is not echoed or retained as part of the command.
  4. If credentials must be loaded from a file, require restrictive file permissions and avoid printing the path or contents in logs.
  5. Update SKILL.md so command examples never contain a secret argument.
  6. Keep application permissions limited to the minimum Feishu or Lark scopes needed to upload and send files or images.
  7. Ensure exceptions and diagnostic output never include the application secret or authorization token.
  8. Rotate any application credentials that may already have been exposed through shell history, process monitoring, terminal capture, or automation logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

描述包含两类核心能力：发送普通文件和发送本地图片。该代码块只覆盖普通文件路径，且实现细节与描述中的文件部分一致：获取 tenant token、上传文件到 im/v1/files、再以 file_key 发送 file 消息。但代码中完全没有图片分支、没有调用 im/v1/images、没有 image_key、也没有 msg_type=image。因此声明范围明显大于实际行为，属于描述与代码能力不一致。除这一点外，代码未发现与声明无关的敏感或额外越权行为。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个既能发送本地普通文件也能发送本地图片的技能，但提供的代码块只包含 send_image.py，且其全部逻辑都围绕图片处理：校验图片路径、获取 token、上传到 im/v1/images、再发送 image 消息。代码中没有任何针对普通文件的分支、im/v1/files 接口调用、file_key 处理或 msg_type=file 发送逻辑。因此描述未准确反映该代码块的实际行为。除此之外，代码没有出现与发送图片无关的可疑越权能力；主要问题是声明覆盖了文件发送，而代码并未实现。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
### 普通文件

1. 获取 tenant access token
2. 调用 `im/v1/files` 上传文件
3. 使用返回的 `file_key` 发送 `msg_type=file`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
### 普通文件

1. 获取 tenant access token
2. 调用 `im/v1/files` 上传文件
3. 使用返回的 `file_key` 发送 `msg_type=file`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill instructs use of Python scripts that perform shell execution and outbound network access, but the manifest declares no explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and makes it easier for an agent to invoke higher-risk capabilities than a reviewer or platform policy would expect.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_file.py (reported line 69)May include surrounding context.

python
def upload_file(base: str, token: str, file_path: str, file_name: str) -> str:
    result = subprocess.run(
        [
            "curl",
            "-sS",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code obtains a tenant token, uploads a local file to Feishu/Lark, and sends a message to a recipient, which transmits user data and metadata over the network. Although it prints status messages, there is no user-facing warning or disclosure that file contents, recipient identifiers, and credentials will be sent to an external service.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_image.py (reported line 71)May include surrounding context.

python
def upload_image(base: str, token: str, image_path: str) -> str:
    result = subprocess.run(
        [
            "curl",
            "-sS",

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all user-facing output are written in Chinese, which imposes a specific language on users without any opt-in or alternative. The file does not document a justified region-specific constraint or provide a language choice.

Content

No source excerpt is available for this finding.