多个飞书

• Outcome: Review
• Latest audit: May 28, 2026 · 9:26 AM UTC
• Version: 1.0.0

Overview

This skill is for legitimate Feishu bot setup, but it can run local shell commands from config-controlled values and persistently stores bot secrets in OpenClaw configuration.

Review or patch scripts/setup_bots.py before running it. Only use config files you created yourself, validate bot names and agent IDs, back up ~/.openclaw/openclaw.json before setup, protect or remove JSON files containing Feishu secrets, restrict Feishu bot permissions where possible, and plan the gateway restart because it can affect active bots.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd, check=True):
    """Run a shell command and return output."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

• Confidence: 99% confidence
• Finding: The script invokes subprocess.run with shell=True on a command string assembled elsewhere from bot configuration values. Because agentId, workspace_path, and bot name are interpolated into shell commands without validation or escaping, a crafted config can trigger arbitrary shell command execution on the host running setup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs users to run shell commands, execute a Python setup script, and edit persistent configuration files, but the skill metadata does not declare any permissions or operational capabilities. This creates a transparency and consent gap: users may invoke a skill expecting low-risk documentation but it actually drives file reads/writes and shell-level changes affecting agent state and gateway configuration.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The setup flow grants shell-command execution capability driven by configuration data, which is broader and more dangerous than necessary for creating bots. In this context, the skill consumes externally supplied bot definitions, so treating those values as shell-safe creates a direct command-injection path during a privileged local setup operation.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The binding step constructs a shell command from bot['agentId'] and bot['name'] and executes it through the shell. A maliciously crafted bot name or agent ID could append additional commands, making the final routing/binding stage another arbitrary code-execution point.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code comments indicate it is backing up the original config, but it writes the backup after mutating the in-memory configuration object. This means the backup contains the already-modified config, undermining recovery and auditability if the update is incorrect or maliciously influenced.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation tells users to handle Feishu App ID, App Secret, Encrypt Key, and Verification Token and to edit ~/.openclaw/openclaw.json, but it does not warn about secret exposure, least-privilege storage, backup, or the risks of modifying persistent config. This can lead to credential leakage in shell history, files, logs, screenshots, or accidental corruption of live configuration.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill instructs users to restart the gateway without warning that this disrupts availability for all connected bots and channels. In a production environment, an uncoordinated restart can interrupt service, drop active sessions, and cause avoidable downtime.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script stores appId, appSecret, encryptKey, and verificationToken into a persistent JSON config on disk without explicit user warning, consent, or permission hardening. In a multi-user or poorly secured environment, these secrets may be exposed through filesystem access, backups, logs, or accidental sharing of the config file.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The backup step duplicates the entire configuration, including Feishu credentials, creating an additional plaintext copy of sensitive data without disclosure. Extra copies increase the attack surface because any compromise of backups, sync tools, or accidental file sharing exposes the same secrets.

Static analysis

No suspicious patterns detected.