Feishu Interactive Cards

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:43 AM UTC
• Version: 1.0.2

Overview

The skill’s Feishu messaging purpose is clear, but it needs Review because it includes under-scoped callback/file-handling patterns that could expose or delete local data if followed or misused.

Install only if you are comfortable running a Feishu callback service that reads OpenClaw Feishu/Gateway credentials and forwards interaction payloads to the configured Gateway. Avoid using the file-deletion examples as written, restrict custom templates to trusted directories, and review the callback server and template path handling before using it in a workspace with sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send-card.js:119

Finding

Template path validation can be bypassed through prefix collisions and symbolic links

Content

View full analysis

resolvedPath.startsWith(dir)); if (!isAllowed) { console.error('Security error: template file must be in an allowed directory'); allowedDirs.forEach(dir => console.error(` - ${dir}`)); console.error(`\nAttempted path: ${resolvedPath}`); process.exit(1); } // 4. Check the file extension const ext = path.extname(resolvedPath).toLowerCase(); if (ext !== '.json') { console.error('Security error: template file must use the .json extension'); process.exit(1); } // 5. Check whether the file exists if (!fs.existsSync(resolvedPath)) { console.error('File does not exist:', resolvedPath); process.exit(1); } // 6. Read and validate JSON try { const content = fs.readFileSync(resolvedPath, 'utf8'); card = JSON.parse(content); ``` ### Technical Analysis The validation uses a raw string-prefix comparison: ```javascript resolvedPath.startsWith(dir) ``` A string prefix does not establish that the candidate is a descendant of the allowed directory. For example, if `/app/examples` is allowed, a file such as `/app/examples-private/card.json` also starts with `/app/examples` and passes the check. The validation also operates on the lexical path returned by `path.resolve()` rather than the canonical filesystem path. A symbolic link located inside an allowed directory can therefore point to a JSON file outside t ...[truncated 1700 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:108

Finding

Documented deletion guard can authorize paths outside the intended workspace

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest describes a card-sending utility, but the documentation also introduces callback collection, local config/secret usage, and forwarding interaction payloads to a gateway. That mismatch is dangerous because reviewers and agents may trust the declared purpose while the actual operational scope includes data movement and secret-bearing integrations not obvious from the top-level description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest describes a card-sending utility, but the documentation also introduces callback collection, local config/secret usage, and forwarding interaction payloads to a gateway. That mismatch is dangerous because reviewers and agents may trust the declared purpose while the actual operational scope includes data movement and secret-bearing integrations not obvious from the top-level description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The manifest describes a card-sending utility, but the documentation also introduces callback collection, local config/secret usage, and forwarding interaction payloads to a gateway. That mismatch is dangerous because reviewers and agents may trust the declared purpose while the actual operational scope includes data movement and secret-bearing integrations not obvious from the top-level description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The manifest describes a card-sending utility, but the documentation also introduces callback collection, local config/secret usage, and forwarding interaction payloads to a gateway. That mismatch is dangerous because reviewers and agents may trust the declared purpose while the actual operational scope includes data movement and secret-bearing integrations not obvious from the top-level description.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

all card interactions to OpenClaw Gateway. For detailed integration guide, see [references/gateway-integration.md](references/gateway-integration.md).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

This skill includes comprehensive security guidelines. Please read [references/security-best-practices.md](references/security-best-practices.md) before impleme

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

This skill includes comprehensive security guidelines. Please read [references/security-best-practices.md](references/security-best-practices.md) before impleme

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The callback example allows a card button payload to carry a file path that is then used to delete a local file. Although the sample uses fs APIs and a workspace prefix check, it still normalizes the idea that interactive card callbacks can invoke arbitrary local destructive actions, which is risky in an agent context where callback data may be attacker-influenced or misrouted.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

Although the YARA hit is on a warning string, it correctly points to a broader destructive-action workflow in the surrounding example: a chat card callback can lead to local file deletion. In the context of an agent skill meant for interactive messaging, embedding autonomous destructive host actions is dangerous because it encourages coupling untrusted UI-triggered input with privileged local side effects.

Content

Scanner excerpt · references/gateway-integration.md (reported line 217)May include surrounding context.

": { "action": "confirm_delete", "file_path": "/path/to/file.txt" } }

text

**处理回调：**
```javascript
if (action.value.action === 'confirm_delete') {
  const filePath = action.value.file_path;
  
  // ⚠️ 安全警告：永远不要直接将用户输入传递给 shell 命令！
  // ❌ 错误示例：await exec({ command: `rm "${filePath}"` });
  // 攻击者可以注入："; rm -rf / #" 来执行任意命令
  
  // ✅ 正确做法：使用 Node.js fs API
  const fs = require('fs').promises;
  const path = require('path');
  
  try {
    // 1. 验证路径（防止目录遍历攻击）
    const safePath = path.resolve(filePath);
    const workspaceRoot = process.cwd();
    
    if (!safePath.startsWith(workspaceRoot)) {
      throw new Error('路径超出工作区范围');
    }
    
    // 2. 检查文件是否存在
    await fs.access(safePath);
    
    // 3. 使用 fs API 删除（安全）
    await fs.unlink(safePath);
    
    // 4. 更新卡片
    awai

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/gateway-integration.md (reported line 217)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-best-practices.md (reported line 16)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/security-best-practices.md (reported line 19)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/gateway-integration.md (reported line 217)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/security-best-practices.md (reported line 16)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/security-best-practices.md (reported line 19)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/security-best-practices.md (reported line 16)May include surrounding context.

安全最佳实践

核心原则

永远不要将用户输入直接传递给 shell 命令或文件系统操作！

这是最常见也是最危险的安全漏洞之一。

常见安全漏洞

1. 命令注入漏洞

❌ 危险示例

javascript

// 用户输入："; rm -rf / #"
const userInput = callback.data.action.value.file;
await exec({ command: `rm ${userInput}` });
// 实际执行：rm ; rm -rf / #
// 结果：删除整个系统！

✅ 安全做法

javascript

// 使用 Node.js 内置 API
const fs = require('fs').promises;
const path = require('path');

const userInput = callback.data.action.value.file;

// 1. 验证和规范化路径
const safePath = path.resolve(userInput);

// 2. 检查路径是否在允许的范围内
const workspaceRoot = process.cwd();
if (!safePath.startsWith(workspaceRoot)) {
  throw new Error('路径超出工作

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-best-practices.md (reported line 50)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："/etc/passwd" 或 "~/.ssh/id_rsa"
const templatePath = args['--template'];
const content = fs.readFileSync(templatePath, 'utf8');
// 攻击者可以读取系统中的任意文件！

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-best-practices.md (reported line 50)May include surrounding context.

❌ 危险示例

javascript

// 用户输入："/etc/passwd" 或 "~/.ssh/id_rsa"
const templatePath = args['--template'];
const content = fs.readFileSync(templatePath, 'utf8');
// 攻击者可以读取系统中的任意文件！

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-best-practices.md (reported line 280)May include surrounding context.

md

// ❌ 错误：显示完整路径
await updateCard(messageId, {
  elements: [
    { tag: "div", text: { content: `文件路径：/home/user/.ssh/id_rsa`, tag: "lark_md" } }
  ]
});

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security-best-practices.md (reported line 280)May include surrounding context.

md

// ❌ 错误：显示完整路径
await updateCard(messageId, {
  elements: [
    { tag: "div", text: { content: `文件路径：/home/user/.ssh/id_rsa`, tag: "lark_md" } }
  ]
});

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# 🎴 Feishu Interactive Cards

Create and send interactive cards to Feishu (Lark) with buttons, forms, polls, and rich UI elements. Use when replying to Feishu messages and there is ANY uncertainty - send an interactive card instead of plain text to let users choose via buttons.

## ✨ Features

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to start a long-running callback server but does not warn that this creates an inbound event listener that must authenticate callbacks, validate payloads, and be safely exposed/operated. In the context of a Feishu integration that 'automatically handles callbacks via long-polling connection,' omission of these operational security caveats can lead users to deploy a listener insecurely, increasing risk of spoofed callbacks, unauthorized actions, or accidental exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documents capabilities that involve reading local configuration and environment-backed credentials, but it declares no explicit tool scope or permission boundaries. This weakens reviewability and can let an agent invoke code paths with access to secrets or local state that users did not clearly authorize.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is explicitly designed around interactive cards and callback handling, which implies retaining state across turns and associating user actions with prior messages. Session persistence is not inherently malicious, but without clear retention limits, scoping, and privacy controls, it can accumulate conversational state and action metadata in ways users may not expect.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: feishu-interactive-cards
version: 1.0.2
description: Create and send interactive cards to Feishu (Lark) with buttons, forms, polls, and rich UI elements. Use when replying to Feishu messages and there is ANY uncertainty - send an interactive card instead of plain text to let users choose via buttons. Automatically handles callbacks via long-polling connection. Use for confirmations, choices, forms, todos, polls, or any scenario requiring user interaction in Feishu.
---

# Feishu Interactive Cards

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition 'ANY uncertainty' is extremely broad and can cause the skill to be selected in many contexts outside its safe or intended use. Overbroad activation increases the chance of unnecessary external messaging, unintended data disclosure to Feishu, and overuse of callback flows that persist state and user actions.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/card-callback-server.js:29