飞书任务Bot身份

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.0.2

Overview

The skill appears to list Feishu tasks as a bot, but it asks users to grant broader task-write authority than the shipped script needs.

Install only if you intend to use a Feishu bot/application identity for task listing. Grant read-only task permission for the current artifact where possible, avoid granting task write scope unless a reviewed write-capable version is actually needed, and prefer pinned installation sources over the README's mutable npx/GitHub examples.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:75

Finding

Unpinned Remote Installation Commands Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:75-79 and README.md:137-141
Vulnerability Type: Unpinned third-party tooling and mutable remote installation source
Risk Level: Medium

Vulnerable Code

bash

# From ClawHub
npx clawhub install feishu-bot-task

# Or from GitHub
npx skills add https://github.com/lixiang92229/feishu-bot-task -y -g

The equivalent commands are repeated in the Chinese installation section at README.md:137-141.

Technical Analysis

The documented installation commands invoke npm-based tools without pinning package versions. If the relevant package is not already installed, npx may retrieve and execute the currently published package version. Consequently, the code executed by the installation process can differ from the code reviewed during this audit.

The GitHub installation command also references a mutable repository URL rather than a reviewed commit hash or signed release. The -g option requests global installation, while -y suppresses interactive confirmation. These options increase the potential effect of a compromised or unexpectedly modified upstream source.

This is a supply-chain weakness rather than evidence that the current repository contains malicious code.

Attack Path

1. An attacker compromises the npm package, the GitHub repository, a maintainer account, or another relevant publishing channel.
2. The attacker publishes a malicious version of the installer or modifies the repository content referenced by the mutable URL.
3. A user follows the documented npx installation command.
4. npx retrieves and executes the unpinned tooling, or the installer retrieves the modified repository content.
5. Attacker-controlled installation logic executes with the privileges of the invoking user and may be installed globally when -g is used.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the accou ...[truncated 398 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each npm-based installer to an explicitly reviewed version, such as npx clawhub@<reviewed-version>.
• Pin GitHub installations to an immutable commit hash or a cryptographically signed release rather than a mutable repository branch.
• Publish checksums or signatures for release artifacts and verify them before installation.
• Remove -g unless global installation is strictly required.
• Avoid -y so users can review installation prompts and requested changes.
• Prefer a package manager lockfile or a controlled installer whose complete dependency graph is version-pinned and integrity-verified.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:82

Finding

Documented Write Permission Exceeds the Skill's Read-Only Requirements

Content

View full analysis

Vulnerability Details

File Location: README.md:82-86; also documented in README.md:128-132 and SKILL.md:42-44
Vulnerability Type: Excessive Feishu application permissions
Risk Level: Medium

Vulnerable Documentation

markdown

### Permissions

In Feishu Open Platform, grant these scopes to your application:

- `task:task:read` — Read task information
- `task:task:write` — Create/update tasks

The implemented task operation is read-only:

python

def list_bot_tasks(token, page_size=20, page_token=""):
    """调用v1接口获取bot自己作为负责人的任务"""
    base_url = "https://open.feishu.cn/open-apis/task/v1/tasks"
    params = {"page_size": page_size}
    if page_token:
        params["page_token"] = page_token

    url = f"{base_url}?{urllib.parse.urlencode(params)}"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
    with urllib.request.urlopen(req) as resp:
        return json.load(resp)

Technical Analysis

The repository implements only a GET request that lists tasks assigned to the Bot. No task creation or update operation is present. Nevertheless, the documentation instructs operators to grant task:task:write, which authorizes behavior beyond the Skill's implemented and declared listing requirement.

This violates the principle of least privilege. The script does not itself exercise the excessive permission, but the application credentials and tenant access token may inherit it. Any compromise or unintended reuse of those credentials would therefore expose write capabilities that the audited operation does not need.

The static pre-scan's sensitive network transmission is otherwise consistent with the declared functionality: the application ID and secret are sent over HTTPS only to Feishu's official tenant-token endpoint, and the resulting bearer token is sent only to Feishu's task API.

Attack Path

1. An operator follows the documenta ...[truncated 1044 chars]

Remediation

View remediation

Remediation Suggestions

• Remove task:task:write from the prerequisites for the current read-only Skill.
• Require only task:task:read for task-listing functionality.
• Update all duplicated permission guidance in README.md and SKILL.md to prevent inconsistent configuration.
• If write operations are added later, document them separately and request write access only when those operations are explicitly enabled.
• Use separate Feishu applications or credentials for read-only and write-capable workflows where practical.
• Periodically review and revoke unnecessary scopes in the Feishu Open Platform.
• Rotate the application secret and invalidate existing tokens if excessive credentials may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/lark-task-bot-list.py (reported line 27)May include surrounding context.

python

url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    data = json.dumps({"app_id": APP_ID, "app_secret": APP_SECRET}).encode()
    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req) as resp:
        result = json.load(resp)
    return result.get("tenant_access_token", "")

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/lark-task-bot-list.py (reported line 40)May include surrounding context.

python

url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    data = json.dumps({"app_id": APP_ID, "app_secret": APP_SECRET}).encode()
    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req) as resp:
        result = json.load(resp)
    return result.get("tenant_access_token", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

md

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest context says the skill manages Feishu tasks as a Bot, including creating tasks, updating status, and assigning members. However, the README's features, usage, and file structure consistently describe only a single listing script that queries tasks via GET /task/v1/tasks and returns paginated results. This is a semantic mismatch between the claimed management scope and the documented implemented behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README instructs users to run npx clawhub install feishu-bot-task without pinning a specific package version. This can cause users to fetch and execute a newer or compromised package at install time, creating a supply-chain risk if the upstream package is altered or hijacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The command npx skills add https://github.com/lixiang92229/feishu-bot-task -y -g relies on unpinned remote resolution and may pull changing code from a GitHub repository. If the repo is compromised or later modified, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The Chinese installation section repeats the unpinned npx clawhub installation pattern, exposing the same mutable-package execution risk. Duplicating the unsafe instruction increases the chance that users will follow it.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The Chinese GitHub-based npx skills add command points to an unpinned repository target, allowing remote code changes to affect later installs. This is a supply-chain hazard because installation behavior is not tied to a fixed artifact.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares it requires environment credentials and makes direct API calls, but it does not define any explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability by leaving access to sensitive capabilities like network use and secret-backed execution implicit rather than narrowly constrained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file describes behavior that accesses sensitive environment variables (FEISHU_APP_ID / FEISHU_APP_SECRET). While it states that credentials are read automatically, it does not explicitly warn users that the skill will use sensitive secrets from the environment or advise caution when running it in shared contexts.

Content

No source excerpt is available for this finding.