多个飞书

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:08 AM UTC
• Version: 1.0.0

Overview

This skill does what it says by setting up Feishu bots, but its setup script gives user-supplied config too much power over shell commands, file paths, credentials, and open bot access policies.

Review this before installing or running it. Use only trusted config files, avoid running the setup script as root, restrict Feishu bot policies to allowlists or pairing where possible, protect or rotate any credentials written to OpenClaw config, and fix the shell=True, path validation, and backup handling issues before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_bots.py:13

Finding

Arbitrary Command Execution Through Shell Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_bots.py, lines 13-18, 27-30, and 163-168
Vulnerability Type: OS command injection through attacker-controlled configuration values
Risk Level: High

Vulnerable Code

python

def run_command(cmd, check=True):
    """Run a shell command and return output."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,
        text=True
    )

python

def create_agent(agent_id, workspace_path):
    """Create a new OpenClaw agent."""
    print(f"Creating agent: {agent_id}")
    cmd = f'openclaw agents add {agent_id} --workspace {workspace_path} --non-interactive'
    run_command(cmd)
    print(f"✓ Agent {agent_id} created")

python

def bind_agents(bots):
    """Bind agents to Feishu accounts."""
    print("Binding agents to Feishu accounts...")
    
    for bot in bots:
        cmd = f"openclaw agents bind --agent {bot['agentId']} --bind feishu:{bot['name']}"
        run_command(cmd, check=False)
        print(f"✓ Bound {bot['agentId']} to {bot['name']}")

Technical Analysis

The script constructs shell command strings using the configuration-controlled agentId and name fields. It then executes those strings with subprocess.run(..., shell=True).

The shell interprets metacharacters such as semicolons, command substitutions, pipes, redirections, and logical operators contained in these values. Neither field is validated nor safely quoted before it reaches the shell. Consequently, a configuration file can inject additional commands rather than merely supplying OpenClaw identifiers.

Setting check=False in bind_agents does not mitigate injection. It only prevents the Python process from terminating when the shell command returns a nonzero status.

Attack Path

1. An attacker creates or modifies the JSON configuration supplied to setup_bots.py.
2. The att ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

• Remove shell=True and pass each command as an argument list:

  python

  subprocess.run(
      [
          "openclaw", "agents", "add", agent_id,
          "--workspace", workspace_path,
          "--non-interactive",
      ],
      shell=False,
      check=True,
      capture_output=True,
      text=True,
  )
  

• Apply the same argument-list approach to the binding command.

• Validate agentId and name against a strict allowlist, such as ^[A-Za-z0-9_-]+$.

• Reject empty, excessively long, or duplicate identifiers.

• Do not rely only on shell quoting. Avoiding shell interpretation is the primary control.

• Report binding failures instead of suppressing them with check=False.

• Run the setup process with the minimum filesystem and OpenClaw privileges required.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup_bots.py:182

Finding

Path Traversal Allows Files to Be Written Outside Agent Workspaces

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_bots.py, lines 68-69, 83-84, 111-112, and 182-184
Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

Vulnerable Code

python

with open(f"{workspace}/SOUL.md", 'w') as f:
    f.write(soul_content)

python

with open(f"{workspace}/IDENTITY.md", 'w') as f:
    f.write(identity_content)

python

with open(f"{workspace}/AGENTS.md", 'w') as f:
    f.write(agents_content)

python

for bot in bots:
    workspace = os.path.expanduser(f"~/.openclay/agents/{bot['agentId']}/workspace")
    create_agent_files(workspace, bot)

Technical Analysis

The configuration-controlled agentId is inserted directly into a filesystem path. The script does not reject path separators or traversal components, resolve the resulting path against an approved base directory, or verify that the destination remains within the intended agent directory.

An identifier containing ../ components can therefore cause the operating system to resolve the workspace outside ~/.openclay/agents. The script opens SOUL.md, IDENTITY.md, and AGENTS.md in write mode, which creates missing files and truncates existing files.

Symbolic links within a reachable path could present an additional redirection risk because the script does not check whether the destination or its parent components are symlinks.

Attack Path

1. An attacker controls or modifies the setup configuration.
2. The attacker supplies an agentId containing traversal components.
3. The script concatenates that value into the nominal workspace path.
4. os.path.expanduser() expands the home directory but does not prevent traversal.
5. The operating system resolves the traversal components when the files are opened.
6. The generated Markdown content is written to SOUL.md, IDENTITY.md, and AGENTS.md at the escaped location.
7. Any ex ...[truncated 582 chars]

Remediation

View remediation

Remediation Suggestions

• Apply the same strict identifier allowlist used to prevent command injection. Agent identifiers should not contain slashes, backslashes, dots used as traversal components, or control characters.

• Construct paths with pathlib.Path and verify containment after resolution:

  python

  base = (Path.home() / ".openclaw" / "agents").resolve()
  workspace = (base / agent_id / "workspace").resolve()
  
  if base not in workspace.parents:
      raise ValueError("Workspace escapes the approved agent directory")
  

• Check every existing parent component for symbolic links or use operating-system facilities that prevent symlink following where available.

• Create workspaces with restrictive permissions.

• Avoid overwriting existing instruction files without explicit operator confirmation or a secure backup.

• Correct the apparent .openclay directory typo so that workspace creation consistently uses the intended .openclaw location.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup_bots.py:135

Finding

Generated Bots Use Unrestricted Access Policies by Default

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_bots.py, lines 135-149
Vulnerability Type: Insecure authorization defaults and violation of least privilege
Risk Level: High

Vulnerable Code

python

config['channels']['feishu']['accounts'][bot['name']] = {
    'appId': bot['appId'],
    'appSecret': bot['appSecret'],
    'encryptKey': bot['encryptKey'],
    'verificationToken': bot['verificationToken'],
    'domain': 'feishu',
    'connectionMode': bot.get('connectionMode', 'websocket'),
    'webhookPath': f"/webhook/feishu/{bot['name']}",
    'dmPolicy': 'open',
    'groupPolicy': 'open',
    'requireMention': False,
    'reactionNotifications': 'off',
    'typingIndicator': True,
    'resolveSenderNames': True
}

Technical Analysis

Every account generated by the script receives an open direct-message policy, an open group policy, and no requirement for users to mention the bot. These settings are hard-coded and cannot be restricted through the input configuration.

This configuration exposes the agent to broader interaction than is normally required under a least-privilege model. A bot added to an unintended group or reachable by an untrusted Feishu user may process requests without an allowlist, pairing requirement, or explicit group invocation.

The resulting severity depends on the tools, data, and permissions assigned to each OpenClaw agent. Agents with access to internal data or privileged tools create the greatest exposure.

Attack Path

1. An operator runs the setup script for an agent that has access to OpenClaw tools or internal information.
2. The script writes dmPolicy: open, groupPolicy: open, and requireMention: false to the account configuration.
3. The bot becomes reachable through direct messages or is added to a group containing an untrusted user.
4. The untrusted user sends instructions to the bot without completing pairing or appearing on ...[truncated 628 chars]

Remediation

View remediation

Remediation Suggestions

• Default direct messages to pairing or allowlist.
• Default group access to allowlist or disabled.
• Set requireMention to True for group interactions.
• Expose these policies as explicit, validated configuration fields rather than hard-coding permissive values.
• Require operators to acknowledge any transition to an open policy.
• Maintain separate allowlists for users and groups.
• Restrict each agent's tools and data access so that exposure of the messaging endpoint does not imply access to sensitive operations.
• Document the security consequences of each policy in SKILL.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_bots.py:151

Finding

Feishu Credentials Are Duplicated in Plaintext Without Enforced File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_bots.py, lines 135-141 and 151-159
Vulnerability Type: Insecure plaintext secret storage and backup handling
Risk Level: Medium

Vulnerable Code

python

config['channels']['feishu']['accounts'][bot['name']] = {
    'appId': bot['appId'],
    'appSecret': bot['appSecret'],
    'encryptKey': bot['encryptKey'],
    'verificationToken': bot['verificationToken'],
    'domain': 'feishu',

python

# Backup original config
backup_path = config_path.with_suffix('.json.bak')
with open(backup_path, 'w') as f:
    json.dump(config, f, indent=2)

# Write updated config
with open(config_path, 'w') as f:
    json.dump(config, f, indent=2)

Technical Analysis

The script places the Feishu application secret, encryption key, and verification token directly in the OpenClaw JSON configuration. It then writes the same mutated configuration to both openclaw.json.bak and openclaw.json.

The files are created with the process's default mode as modified by its umask. The script does not explicitly enforce owner-only permissions. On systems with a permissive umask or pre-existing files with broad permissions, other local users may be able to read the credentials.

The backup is also created after the in-memory configuration has been modified. It therefore does not preserve the original configuration as the comment states; instead, it creates an additional secret-bearing copy and expands the credential exposure surface.

Attack Path

1. An operator supplies valid Feishu credentials and runs the setup script.
2. The script inserts those credentials into the in-memory OpenClaw configuration.
3. The modified configuration is serialized to both the primary file and the .bak file.
4. File access permissions are inherited from the environment or retained from pre-existing files.
5. A local user or process with read access discovers eit ...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

• Store credentials in a dedicated secret manager where supported, and place only secret references in the JSON configuration.
• If plaintext storage is unavoidable, create and maintain both files with mode 0600.
• Verify that ~/.openclaw is accessible only to the owning account.
• Write configuration changes atomically through a temporary file created with restrictive permissions, then replace the destination.
• Create a backup of the original file before mutating the configuration.
• Avoid secret-bearing backups unless they are operationally required.
• Protect necessary backups with owner-only permissions, encryption, retention limits, and secure deletion procedures.
• Check the permissions of pre-existing destination files and fail securely if they are broader than intended.
• Rotate all affected Feishu credentials if either configuration copy may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The tool invocation pattern is dangerous because subprocess.run is called with shell=True, and downstream commands interpolate untrusted config values into a shell command string. In this skill context, bot metadata comes from a JSON config file, so a maliciously crafted agentId or name could achieve arbitrary command execution on the operator's machine.

Content

Scanner excerpt · scripts/setup_bots.py (reported line 16)May include surrounding context.

python

def run_command(cmd, check=True):
    """Run a shell command and return output."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs users to run a Python setup script, edit configuration files, and execute administrative CLI commands, but it does not declare any tool scope or permissions boundary. That mismatch can cause users or orchestration systems to grant broader file and shell access than expected, increasing the chance of unintended filesystem modification or command execution during skill use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill collects and stores Feishu App ID, App Secret, Encrypt Key, and Verification Token in configuration without warning that these are sensitive credentials. Users may place secrets in plaintext files, examples, logs, or shared workspaces, leading to credential theft and unauthorized control of Feishu bot integrations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

If you need more control, follow these manual steps:

Step 1: Create Agent

bash

openclaw agents add <agent-id> --workspace /path/to/workspace --non-interactive

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual setup directs users to modify the main OpenClaw configuration with live bot credentials and permissive settings such as dmPolicy=open, groupPolicy=open, and requireMention=false, but it provides no warning about system-wide impact. This can unintentionally expose the bot to unsolicited direct and group messages, broaden attack surface, and enable abuse or data leakage across the messaging environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON config defines all bot roles, taglines, descriptions, and mottos exclusively in Chinese, which effectively constrains the skill personas to a specific language/locale. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific configuration, so it may violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The helper executes shell commands with shell=True, and those commands are later built using untrusted bot fields such as agentId and name. This creates a command-injection path where crafted configuration values can execute arbitrary OS commands during setup.

Content

Scanner excerpt · scripts/setup_bots.py (reported line 16)May include surrounding context.

python

def run_command(cmd, check=True):
    """Run a shell command and return output."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_bots.py (reported line 30)May include surrounding context.

python

def create_agent(agent_id, workspace_path):
    """Create a new OpenClaw agent."""
    print(f"Creating agent: {agent_id}")
    cmd = f'openclaw agents add {agent_id} --workspace {workspace_path} --non-interactive'
    run_command(cmd)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sets default role, tagline, style, responsibilities, description, and motto in Chinese, which imposes a specific language/locale on generated agent files. There is no opt-in, language selection, or justification that this skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code stores sensitive values including appId, appSecret, encryptKey, and verificationToken into ~/.openclaw/openclaw.json and overwrites that config file. Although the script prints progress messages after the fact, there is no user-facing warning or confirmation before modifying a credential-bearing configuration file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment at L164 says 'Backup original config', but the code has already mutated the in-memory config with new Feishu account entries before writing it at L166-L167. This means the .bak file contains the updated configuration rather than the original pre-change state, contradicting the documented intent of preserving the original config.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_bots.py (reported line 207)May include surrounding context.

python

print()
    
    # Step 2: Create agent files
    for bot in bots:
        workspace = os.path.expanduser(f"~/.openclay/agents/{bot['agentId']}/workspace")
        create_agent_files(workspace, bot)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The sample personality fields and later role examples are written as Chinese-only bot identities and slogans, while the surrounding documentation is in English and does not state that the skill is China-specific or requires Chinese output. This can amount to an implicit language policy choice without user opt-in.

Content

No source excerpt is available for this finding.