Feishu Setup Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Feishu/OpenClaw setup guide, but it recommends broad Feishu permissions and mutable plugin installs that need careful review before use.

Review this skill before installing. Use pinned, verified plugin versions; start with an IM-only scope/tool set; disable user-identity sending, chat history/search, batch authorization, and write-capable tools unless there is a specific business need; secure the webhook endpoint and stored OAuth tokens; and limit the Feishu app rollout to test users or departments first.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47
• Finding: Unpinned Third-Party Plugin Installation Creates a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47-53 **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # In OpenClaw project directory npx openclaw plugin install @larksuite/openclaw-lark # Optional Miaoda extensions npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda-coding ``` ### Technical Analysis The setup instructions install third-party plugins without pinning reviewed versions or verifying package integrity. The use of `npx` may also download and execute a mutable version of the OpenClaw CLI if it is not already installed locally. Because package names resolve through an external package registry, the effective code installed by these commands can change after the Skill has been audited. A compromised publisher account, malicious future release, registry compromise, or dependency-chain compromise could therefore introduce arbitrary code into the OpenClaw environment. The network access involved in downloading plugins is functionally necessary for installation, but using mutable package references exceeds the minimum supply-chain trust required. The Skill does not specify expected versions, integrity hashes, a lockfile, an approved registry, or publisher verification procedures. ### Attack Path 1. An attacker compromises a plugin publisher, transitive dependency, package registry, or future package release. 2. The attacker publishes malicious code under one of the documented package names. 3. An administrator follows the Skill and runs the unpinned installation command. 4. `npx` or the OpenClaw plugin installer resolves and downloads the malicious version. 5. Package installation hooks or plugin initialization execute attacker-controlled code. 6. The malicious component obtains the privileges of the installing user or the OpenClaw process and may access appl ...[truncated 710 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every package to a specifically reviewed version, for example: ```bash openclaw plugin install @larksuite/openclaw-lark@<REVIEWED_VERSION> ``` 2. Require the OpenClaw CLI to be installed from a verified source instead of implicitly downloading it through `npx`. 3. Record and verify package integrity hashes or use a lockfile that includes integrity metadata. 4. Document the expected package registry and reject packages resolved from unapproved registries. 5. Verify package ownership, signatures, provenance attestations, and release history before installation. 6. Keep optional Miaoda extensions out of the default workflow and install them only when their functionality is explicitly required. 7. Run plugin installation and review in an isolated environment before deploying packages to a production OpenClaw instance. 8. Apply dependency monitoring and repeat the security review before changing pinned versions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/openclaw-config-reference.md:69
• Finding: Recommended Full Tool Profile Grants Excessive Read, Write, Impersonation, and OAuth Authority<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw-config-reference.md`, lines 69-126 **Vulnerability Type**: Excessive tool authorization and violation of least privilege **Risk Level**: High ### Vulnerable Configuration ```json5 { tools: { profile: 'full', alsoAllow: [ // === Bitable (多维表格) === 'feishu_bitable_app', 'feishu_bitable_app_table', 'feishu_bitable_app_table_field', 'feishu_bitable_app_table_record', 'feishu_bitable_app_table_view', // Optional: view management // === Calendar (日历) === 'feishu_calendar_calendar', 'feishu_calendar_event', 'feishu_calendar_event_attendee', 'feishu_calendar_freebusy', // === Chat (群聊) === 'feishu_chat', 'feishu_chat_members', // === Docs (文档) === 'feishu_create_doc', 'feishu_fetch_doc', 'feishu_update_doc', // === Drive & Media === 'feishu_doc_comments', // Optional: document comments 'feishu_doc_media', // Optional: document media 'feishu_drive_file', // Optional: drive file management // === User & Contact === 'feishu_get_user', 'feishu_search_user', // === IM (消息) === 'feishu_im_bot_image', // Bot downloads images/files 'feishu_im_user_fetch_resource', // User identity downloads 'feishu_im_user_get_messages', // Read chat history 'feishu_im_user_get_thread_messages', // Read thread messages 'feishu_im_user_message', // Send as user identity 'feishu_im_user_search_messages', // Cross-chat message search // === OAuth === 'feishu_oauth', // Revoke authorization 'feishu_oauth_batch_auth', // Batch authorize all scopes // === Search === 'feishu_search_doc_wiki', // Search docs & wiki // === Sheets === 'fe ...[truncated 3819 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `profile: 'full'` with the narrowest available profile. 2. Provide a default IM-only tool allowlist containing only the tools needed to receive and send bot messages. 3. Remove every optional tool from `alsoAllow` unless the administrator explicitly selects the associated feature. 4. Deny the following sensitive tools by default: - `feishu_im_user_message` - `feishu_im_user_search_messages` - `feishu_im_user_get_messages` - `feishu_im_user_get_thread_messages` - `feishu_im_user_fetch_resource` - `feishu_oauth_batch_auth` - All write, delete, and management tools not required by the deployment 5. Separate read-only and write-capable configuration examples. 6. Require explicit human confirmation before sending as a user, modifying or deleting resources, changing attendees, or revoking authorization. 7. Restrict tools by user, group, tenant, resource, and operation wherever the platform supports it. 8. Use allowlists rather than broad profiles plus deny-lists. 9. Log sensitive tool invocations and alert on cross-chat searches, bulk authorization, user impersonation, and destructive operations. 10. Test effective permissions after configuration to verify that commented examples have not been mistaken for enforced denials. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/feishu-app-config.md:35
• Finding: Setup Workflow Recommends Broad Sensitive OAuth Scopes Without Feature-Level Opt-In<![CDATA[ ## Vulnerability Details **File Location**: `references/feishu-app-config.md`, lines 35-91 **Vulnerability Type**: Excessive OAuth scope assignment **Risk Level**: High ### Vulnerable Configuration Guidance ```markdown ### IM (消息与群组) — Required | Scope | Description | |-------|-------------| | `im:message` | Send and receive messages | | `im:message:send_as_bot` | Send messages as bot | | `im:resource` | Access message resources (images, files) | | `im:chat` | Access chat/group info | | `im:chat:readonly` | Read chat info | ### Contact (通讯录) | Scope | Description | |-------|-------------| | `contact:user.id:readonly` | Read user IDs | | `contact:user.base:readonly` | Read basic user info (name, avatar) | | `contact:user.phone:readonly` | Read phone numbers | | `contact:user.email:readonly` | Read email addresses | | `contact:user.department_id:readonly` | Read department IDs | ### Calendar (日历) | Scope | Description | |-------|-------------| | `calendar:calendar` | Manage calendars | | `calendar:calendar:readonly` | Read calendar info | | `calendar:event` | Manage events | | `calendar:event:readonly` | Read events | | `calendar:freebusy:readonly` | Read free/busy status | ### Docs & Drive (云文档) | Scope | Description | |-------|-------------| | `docx:document` | Read and write documents | | `docx:document:readonly` | Read documents | | `drive:drive` | Access drive files | | `drive:drive:readonly` | Read drive files | | `sheets:spreadsheet` | Access spreadsheets | | `bitable:app` | Access Bitable (multidimensional tables) | | `bitable:app:readonly` | Read Bitable data | | `wiki:wiki` | Access Wiki | | `wiki:wiki:readonly` | Read Wiki | ### Search (搜索) | Scope | Description | |-------|-------------| | `search:app` | Search across Feishu | ### Approval (审批) — Optional | Scope | Description | |-------|-------------| | `approval:approval` | Access approval workflows | | `approval:approval:readonly` | Read approvals | ``` ### Technical Analysi ...[truncated 3016 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the IM-only scope set the documented default. 2. Organize scopes into explicit feature-level opt-in sections and instruct administrators to enable a section only when its associated tools are enabled. 3. Prefer read-only scopes over write-capable scopes whenever the deployment only reads data. 4. Remove phone and email scopes from the standard configuration; require a documented business need before enabling them. 5. Keep global search, drive write, wiki write, Bitable write, spreadsheet, task, and approval permissions disabled by default. 6. Do not request both read-only and read/write versions of a permission unless the Feishu API specifically requires both. 7. Avoid batch authorization of all scopes. Request incremental authorization when a user invokes a feature that requires it. 8. Clearly document what information each scope exposes, whether it uses app or user identity, and which operations can modify or delete data. 9. Limit app availability to specific test users or departments before broader release. 10. Periodically review and revoke unused scopes and stored OAuth grants. 11. Protect stored tokens using an approved secret store, encryption at rest, restrictive filesystem or service permissions, and token rotation procedures. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Recommending batch authorization of all scopes encourages granting the plugin the maximum possible access in one step, which defeats least-privilege and increases blast radius if the integration is misused or compromised. In the Feishu/OpenClaw context, broad OAuth consent can expose messages, files, calendars, contacts, and other enterprise data far beyond what a deployment actually needs.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

|-------|-------------|
| `feishu-bitable` | Bitable creation, query, editing. 27 field types, advanced filtering, batch ops. |
| `feishu-calendar` | Calendar & event management, attendee management, free/busy query. |
| `feishu-channel-rules` | Lark/Feishu channel output rules. Always active. |
| `feishu-create-doc` | Create cloud docs from Markdown. |
| `feishu-fetch-doc` | Read cloud doc content as Markdown. |
| `feishu-im-read` | IM message reading: history, thread, search, resource download. |

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Using `npx openclaw plugin install ...` without a pinned package version causes the latest package version to be fetched at execution time, making the setup non-reproducible and exposing users to supply-chain risk if a malicious or compromised release is published. Because this skill is an installation guide, users are likely to copy-paste the command directly, which increases the chance of executing unintended code from the registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The command `npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda` is unpinned, so it may resolve to whatever version is current at runtime. This creates a supply-chain exposure where a compromised new release or dependency could execute attacker-controlled code during installation, especially dangerous in a setup guide that encourages direct execution.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The unpinned `npx openclaw plugin install @lark-apaas/openclaw-extension-miaoda-coding` command allows execution of whatever package versions are latest when the user runs it. In the context of an agent skill that provisions integrations and extensions, this increases the risk of supply-chain compromise and inconsistent deployments across environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The webhook setup instructions tell users to point Feishu event delivery at an OpenClaw endpoint but do not warn that message events and other workspace data will be transmitted to that endpoint. In a deployment guide, this omission can cause administrators to expose potentially sensitive user, chat, or metadata to an externally reachable service without considering trust boundaries, retention, transport security, or event validation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to enable a very broad set of Feishu scopes, including sensitive contact data, calendars, documents, drive content, search, and approvals, without clearly separating truly required permissions from optional ones or warning about the privacy and data-exposure implications. In an integration setup skill, this can lead operators to overprovision the app, expanding blast radius if the bot, plugin, or credentials are compromised.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

After configuring:
1. Create a version under "Version Management & Release" (版本管理与发布)
2. Submit for review (internal apps may auto-approve)
3. Set availability scope:
   - **All employees** (全员可见)
   - **Specific departments/users** (指定范围)

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This reference explicitly recommends enabling Feishu capabilities that can read chat history, search messages across chats, download resources, and send messages as a user identity, but it does not pair them with prominent warnings, consent requirements, or least-privilege guidance. In a setup guide, presenting these tools as normal defaults increases the chance that operators will over-provision powerful surveillance and impersonation features without understanding the privacy and abuse implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide states that OAuth tokens are stored for subsequent use but does not mention retention period, storage protection, revocation expectations, or privacy implications. In a setup guide for a real integration, this can lead operators to implement persistent token storage without adequate safeguards, increasing the risk of unauthorized access to Feishu user data if tokens are exposed or retained too long.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document marks chat-history and message-search capabilities as recommended without any privacy, retention, or least-privilege warning, even though these tools enable broad access to user communications. In a setup guide, this framing can normalize over-permissioning and lead operators to enable surveillance-like capabilities by default.

Static analysis

No suspicious patterns detected.