ClawHub
Back to skill

Security audit

Feishu Bot Connector

Security checks across malware telemetry and agentic risk

Overview

This Feishu bot setup skill mostly does what it says, but it automatically changes OpenClaw configuration, stores bot secrets, and restarts the gateway without strong safeguards.

Install only if you intend this skill to edit your OpenClaw configuration and briefly restart the gateway. Treat the Feishu App Secret as a credential: avoid putting real secrets directly on the command line, check permissions on ~/.openclaw and its backups, verify the target agent and routing mode before running, and plan for a short service interruption.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill performs a service restart as an automatic side effect after editing configuration, which can disrupt unrelated workloads and changes runtime state beyond simple bot configuration. In a skill context, restarting the OpenClaw gateway affects availability and can cause denial of service or unexpected behavior if invoked at the wrong time or without user confirmation.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The script invokes privileged OpenClaw CLI subprocesses to change global session settings and restart the gateway, which are operationally sensitive actions not strictly necessary for merely writing Feishu bot configuration. Even though the commands are hard-coded and not obviously shell-injection prone, they expand the skill's authority and create hidden side effects that can alter system behavior and availability.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs collection of highly sensitive credentials (App Secret) and states it will automatically modify configuration and restart the Gateway, but it does not prominently warn users about secret handling, persistence, or service disruption. This creates a real risk of unsafe credential disclosure, accidental configuration changes, and unexpected downtime, especially because the skill is user-invokable and framed as a convenience workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:169