Feishu Setup Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Feishu/OpenClaw setup guide, but it recommends broad Feishu permissions and mutable plugin installs that need careful review before use.

Review this skill before installing. Use pinned, verified plugin versions; start with an IM-only scope/tool set; disable user-identity sending, chat history/search, batch authorization, and write-capable tools unless there is a specific business need; secure the webhook endpoint and stored OAuth tokens; and limit the Feishu app rollout to test users or departments first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

``` 2. Require the OpenClaw CLI to be installed from a verified source instead of implicitly downloading it through `npx`. 3. Record and verify package integrity hashes or use a lockfile that includes integrity metadata. 4. Document the expected package registry and reject packages resolved from unapproved registries. 5. Verify package ownership, signatures, provenance attestations, and release history before installation. 6. Keep optional Miaoda extensions out of the default workflow and install them only when their functionality is explicitly required. 7. Run plugin installation and review in an isolated environment before deploying packages to a production OpenClaw instance. 8. Apply dependency monitoring and repeat the security review before changing pinned versions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/openclaw-config-reference.md:69

Finding

Recommended Full Tool Profile Grants Excessive Read, Write, Impersonation, and OAuth Authority

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/feishu-app-config.md:35

Finding

Setup Workflow Recommends Broad Sensitive OAuth Scopes Without Feature-Level Opt-In

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Recommending batch authorization of all scopes encourages granting the plugin the maximum possible access in one step, which defeats least-privilege and increases blast radius if the integration is misused or compromised. In the Feishu/OpenClaw context, broad OAuth consent can expose messages, files, calendars, contacts, and other enterprise data far beyond what a deployment actually needs.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/tool-matrix.md (reported line 122)May include surrounding context.

md

|-------|-------------|
| `feishu-bitable` | Bitable creation, query, editing. 27 field types, advanced filtering, batch ops. |
| `feishu-calendar` | Calendar & event management, attendee management, free/busy query. |
| `feishu-channel-rules` | Lark/Feishu channel output rules. Always active. |
| `feishu-create-doc` | Create cloud docs from Markdown. |
| `feishu-fetch-doc` | Read cloud doc content as Markdown. |
| `feishu-im-read` | IM message reading: history, thread, search, resource download. |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx openclaw plugin install ... without a pinned package version causes the latest package version to be fetched at execution time, making the setup non-reproducible and exposing users to supply-chain risk if a malicious or compromised release is published. Because this skill is an installation guide, users are likely to copy-paste the command directly, which increases the chance of executing unintended code from the registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda is unpinned, so it may resolve to whatever version is current at runtime. This creates a supply-chain exposure where a compromised new release or dependency could execute attacker-controlled code during installation, especially dangerous in a setup guide that encourages direct execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda-coding command allows execution of whatever package versions are latest when the user runs it. In the context of an agent skill that provisions integrations and extensions, this increases the risk of supply-chain compromise and inconsistent deployments across environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The webhook setup instructions tell users to point Feishu event delivery at an OpenClaw endpoint but do not warn that message events and other workspace data will be transmitted to that endpoint. In a deployment guide, this omission can cause administrators to expose potentially sensitive user, chat, or metadata to an externally reachable service without considering trust boundaries, retention, transport security, or event validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to enable a very broad set of Feishu scopes, including sensitive contact data, calendars, documents, drive content, search, and approvals, without clearly separating truly required permissions from optional ones or warning about the privacy and data-exposure implications. In an integration setup skill, this can lead operators to overprovision the app, expanding blast radius if the bot, plugin, or credentials are compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/feishu-app-config.md (reported line 128)May include surrounding context.

md

After configuring:
1. Create a version under "Version Management & Release" (版本管理与发布)
2. Submit for review (internal apps may auto-approve)
3. Set availability scope:
   - **All employees** (全员可见)
   - **Specific departments/users** (指定范围)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This reference explicitly recommends enabling Feishu capabilities that can read chat history, search messages across chats, download resources, and send messages as a user identity, but it does not pair them with prominent warnings, consent requirements, or least-privilege guidance. In a setup guide, presenting these tools as normal defaults increases the chance that operators will over-provision powerful surveillance and impersonation features without understanding the privacy and abuse implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide states that OAuth tokens are stored for subsequent use but does not mention retention period, storage protection, revocation expectations, or privacy implications. In a setup guide for a real integration, this can lead operators to implement persistent token storage without adequate safeguards, increasing the risk of unauthorized access to Feishu user data if tokens are exposed or retained too long.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document marks chat-history and message-search capabilities as recommended without any privacy, retention, or least-privilege warning, even though these tools enable broad access to user communications. In a setup guide, this framing can normalize over-permissioning and lead operators to enable surveillance-like capabilities by default.

Content

No source excerpt is available for this finding.