ClawHub
Back to skill

Security audit

Feishu DM Sender

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Feishu messaging helper that mostly does what it says, but it can send sensitive message content to the wrong recipient because name matching is fuzzy and unconfirmed.

Review before installing. Use explicit open_id or chat_id values for sensitive messages, avoid short or partial contact names, and require human confirmation for recipient and message text when sending confidential business information through Feishu.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send.py:63
Finding

Ambiguous Contact Matching May Send Sensitive Messages to the Wrong Recipient

Content
View full analysis
Remediation
View remediation
1: raise ValueError("Ambiguous recipient label; use an exact ID") ``` 3. If partial matching is retained, collect all substring matches and proceed only when exactly one candidate exists. 4. Require an explicit `open_id`, `chat_id`, `user_id`, or `union_id` when a label is absent or ambiguous. 5. Consider returning candidate labels in an error response so the caller can choose explicitly, while avoiding unnecessary exposure of contact identifiers. 6. Add tests covering duplicate labels, overlapping labels, short substrings, empty labels, exact matches, and deterministic rejection of ambiguous input. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: feishu-send-message
description: |
  Proactively send messages to Feishu (Lark) users or group chats from your OpenClaw agent.
  Supports name-based lookup from DM contacts config, open_id, and chat_id.
  Zero dependencies — uses only Python 3 stdlib. Reads credentials from openclaw.json automatically.
  Use when: agent needs to notify someone, send task results, or communicate with team members on Feishu.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly performs file reads for local credentials/config and makes outbound network requests to Feishu, but the manifest does not declare an explicit tool scope or permission boundary. This increases the chance of unintended invocation or overbroad agent use without operators understanding that local config data and message content will be sent externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description emphasizes convenience but does not clearly warn that message contents and recipient identifiers are transmitted to an external third-party service. Users or orchestrators may invoke the skill without realizing they are exporting data off-platform, which creates confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The activation text is broad enough that many ordinary 'notify someone' or 'send results' tasks may trigger this skill automatically, causing external delivery of potentially sensitive content. In an agent ecosystem, ambiguous activation conditions can become a security issue because they expand when a data-exporting skill is selected.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.