ClawHub
Back to skill

Security audit

feishu-duoge002

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims, but it makes persistent bot and gateway changes with broad default access and weak handling of secrets and command inputs.

Review before installing or running. Use only config JSON files you created and trust, back up ~/.openclaw/openclaw.json first, protect files containing Feishu secrets, avoid committing them, and tighten each bot with allowlists or mention requirements before restarting the gateway.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_command(cmd: str, check: bool = True) -> str:
    """运行命令并返回输出"""
    print(f"Running: {cmd}")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if check and result.returncode != 0:
        print(f"Error: {result.stderr}")
        print(f"Exit code: {result.returncode}")
Confidence
98% confidence
Finding
The script builds a shell command as a single string and executes it with shell=True, which allows shell metacharacters in bot-supplied values such as agent_id or workspace_path to alter the command. Because those values come from a JSON config file and are not validated or escaped, an attacker who can influence that file could trigger arbitrary command execution under the user's account.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs users to place Feishu credentials such as appSecret, encryptKey, and verificationToken directly into a JSON file, but provides no warning about secret handling, file permissions, redaction, or avoiding commits to version control. This creates a realistic risk of credential leakage through shell history, backups, logs, shared workspaces, or repository exposure, which could allow unauthorized access to the associated Feishu bot integrations.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill recommends extracting user IDs from gateway logs to populate allowlists but does not warn that logs may contain sensitive identifiers or other operational data. While user IDs alone are usually less sensitive than secrets, careless log handling can expose private identifiers, message metadata, or authentication-related context to unauthorized viewers.

Static analysis

No suspicious patterns detected.