Feishu Bot Connector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate Feishu bot setup purpose, but it handles secrets, opens bot access broadly by default, and automatically changes and restarts OpenClaw.

Review this before installing in a real OpenClaw environment. Do not pass real Feishu App Secrets in shell commands; prefer a protected secret input method or manually edit secured config. Set restrictive DM access such as pairing or an allowlist instead of the default open access, review the generated configuration before restart, and confirm that config and backup files are owner-only and retained only as needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:186

Finding

Feishu App Secret Exposed Through Command-Line Arguments

Content

View full analysis

Feishu App ID (required) --app-secret Feishu App Secret (required) ``` ### Technical Analysis The documented and implemented interface requires the Feishu App Secret to be supplied as a command-line argument. Command-line secrets can be exposed through shell history, process inspection utilities, process-monitoring software, diagnostic data, terminal logs, and command auditing systems. The parser reads the credential directly from `process.argv`. Although the implementation does not print the secret, avoiding console output does not protect it from operating-system-level process inspection or shell-history retention. The secret is subsequently written into `~/.openclaw/openclaw.json` and copied into timestamped backups. Those operations increase the number of persistent copies, although filesystem permissions were not explicitly controlled by this implementation. ### Attack Path 1. A user follows the documented command and supplies a real Feishu App Secret using `--app-secret`. 2. The shell records the complete command in its history, or the operating system exposes the ...[truncated 799 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:126

Finding

New Bot Accounts Default to Unrestricted Direct-Message Access

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:9

Finding

Unnecessary Third-Party Readline Dependency Introduces Avoidable Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:107

Finding

Security-Relevant Configuration Values Are Persisted Without Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill appears capable of accessing environment-derived secrets or runtime configuration while declaring no explicit tool scope or permissions boundary. In a skill that handles bot credentials and changes gateway configuration, missing scope declarations reduce reviewability and can let the skill access or influence sensitive resources beyond what users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to provide an App Secret and describes modifying persistent configuration and restarting the Gateway, but it does not prominently warn about credential sensitivity, storage handling, or the operational impact of a restart. This creates real risk of secret exposure, unsafe logging, accidental config corruption, or unexpected service interruption during use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill invokes external openclaw CLI commands (config set and gateway restart) after modifying configuration, which goes beyond passive file editing and causes immediate side effects on the host environment. In a skill context, this is risky because running external commands can change global agent behavior, disrupt service availability, and expands the attack surface if the PATH-resolved openclaw binary is replaced or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The user-facing help text and examples are presented only in Chinese, which effectively forces a specific language for interacting with the skill. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JavaScript file contains natural-language comments and error strings entirely in Chinese, including messages returned to users such as configuration validation errors. Because the skill forces a specific language without any opt-in, fallback, or documented locale restriction, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language description, invocation phrases, and usage instructions are all presented in Chinese, which effectively forces a specific language for activation and operation. There is no indication that the skill supports language choice or that the Chinese-only constraint is intentional for a region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description string is entirely in Chinese ("飞书多账户机器人配置管理"), which indicates a language-specific presentation without any accompanying note that the skill is region-specific or that users can choose another language. Under the policy rules, language constraints should either be optional for the user or clearly justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"start": "node index.js"
  },
  "dependencies": {
    "readline": "^1.3.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:169