飞书任务Bot身份

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:32 AM UTC
• Version: 1.0.2

Overview

The skill appears to list Feishu tasks as a bot, but it asks users to grant broader task-write authority than the shipped script needs.

Install only if you intend to use a Feishu bot/application identity for task listing. Grant read-only task permission for the current artifact where possible, avoid granting task write scope unless a reviewed write-capable version is actually needed, and prefer pinned installation sources over the README's mutable npx/GitHub examples.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:75
• Finding: Unpinned Remote Installation Commands Create a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:75-79` and `README.md:137-141` **Vulnerability Type**: Unpinned third-party tooling and mutable remote installation source **Risk Level**: Medium ### Vulnerable Code ```bash # From ClawHub npx clawhub install feishu-bot-task # Or from GitHub npx skills add https://github.com/lixiang92229/feishu-bot-task -y -g ``` The equivalent commands are repeated in the Chinese installation section at `README.md:137-141`. ### Technical Analysis The documented installation commands invoke npm-based tools without pinning package versions. If the relevant package is not already installed, `npx` may retrieve and execute the currently published package version. Consequently, the code executed by the installation process can differ from the code reviewed during this audit. The GitHub installation command also references a mutable repository URL rather than a reviewed commit hash or signed release. The `-g` option requests global installation, while `-y` suppresses interactive confirmation. These options increase the potential effect of a compromised or unexpectedly modified upstream source. This is a supply-chain weakness rather than evidence that the current repository contains malicious code. ### Attack Path 1. An attacker compromises the npm package, the GitHub repository, a maintainer account, or another relevant publishing channel. 2. The attacker publishes a malicious version of the installer or modifies the repository content referenced by the mutable URL. 3. A user follows the documented `npx` installation command. 4. `npx` retrieves and executes the unpinned tooling, or the installer retrieves the modified repository content. 5. Attacker-controlled installation logic executes with the privileges of the invoking user and may be installed globally when `-g` is used. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the accou ...[truncated 398 chars]
• Remediation: ## Remediation Suggestions - Pin each npm-based installer to an explicitly reviewed version, such as `npx clawhub@<reviewed-version>`. - Pin GitHub installations to an immutable commit hash or a cryptographically signed release rather than a mutable repository branch. - Publish checksums or signatures for release artifacts and verify them before installation. - Remove `-g` unless global installation is strictly required. - Avoid `-y` so users can review installation prompts and requested changes. - Prefer a package manager lockfile or a controlled installer whose complete dependency graph is version-pinned and integrity-verified.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: README.md:82
• Finding: Documented Write Permission Exceeds the Skill's Read-Only Requirements## Vulnerability Details **File Location**: `README.md:82-86`; also documented in `README.md:128-132` and `SKILL.md:42-44` **Vulnerability Type**: Excessive Feishu application permissions **Risk Level**: Medium ### Vulnerable Documentation ```markdown ### Permissions In Feishu Open Platform, grant these scopes to your application: - `task:task:read` — Read task information - `task:task:write` — Create/update tasks ``` The implemented task operation is read-only: ```python def list_bot_tasks(token, page_size=20, page_token=""): """调用v1接口获取bot自己作为负责人的任务""" base_url = "https://open.feishu.cn/open-apis/task/v1/tasks" params = {"page_size": page_size} if page_token: params["page_token"] = page_token url = f"{base_url}?{urllib.parse.urlencode(params)}" req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"}) with urllib.request.urlopen(req) as resp: return json.load(resp) ``` ### Technical Analysis The repository implements only a GET request that lists tasks assigned to the Bot. No task creation or update operation is present. Nevertheless, the documentation instructs operators to grant `task:task:write`, which authorizes behavior beyond the Skill's implemented and declared listing requirement. This violates the principle of least privilege. The script does not itself exercise the excessive permission, but the application credentials and tenant access token may inherit it. Any compromise or unintended reuse of those credentials would therefore expose write capabilities that the audited operation does not need. The static pre-scan's sensitive network transmission is otherwise consistent with the declared functionality: the application ID and secret are sent over HTTPS only to Feishu's official tenant-token endpoint, and the resulting bearer token is sent only to Feishu's task API. ### Attack Path 1. An operator follows the documenta ...[truncated 1044 chars]
• Remediation: ## Remediation Suggestions - Remove `task:task:write` from the prerequisites for the current read-only Skill. - Require only `task:task:read` for task-listing functionality. - Update all duplicated permission guidance in `README.md` and `SKILL.md` to prevent inconsistent configuration. - If write operations are added later, document them separately and request write access only when those operations are explicitly enabled. - Use separate Feishu applications or credentials for read-only and write-capable workflows where practical. - Periodically review and revoke unnecessary scopes in the Feishu Open Platform. - Rotate the application secret and invalidate existing tokens if excessive credentials may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    data = json.dumps({"app_id": APP_ID, "app_secret": APP_SECRET}).encode()
    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req) as resp:
        result = json.load(resp)
    return result.get("tenant_access_token", "")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    data = json.dumps({"app_id": APP_ID, "app_secret": APP_SECRET}).encode()
    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"})
    with urllib.request.urlopen(req) as resp:
        result = json.load(resp)
    return result.get("tenant_access_token", "")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

`feishu-bot-task` is an OpenClaw Skill that enables Bot/Application identity operations on Feishu (Lark) Tasks.

This Skill solves a critical limitation: Feishu's official `lark-task` Skill uses the v2 API (`GET /task/v2/tasks`), which **does not support Bot identity** and will fail with `Invalid access token`. This Skill uses the v1 API (`GET /task/v1/tasks`) which **fully supports Bot identity**.

### Why This Exists

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest context says the skill manages Feishu tasks as a Bot, including creating tasks, updating status, and assigning members. However, the README's features, usage, and file structure consistently describe only a single listing script that queries tasks via `GET /task/v1/tasks` and returns paginated results. This is a semantic mismatch between the claimed management scope and the documented implemented behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The README instructs users to run `npx clawhub install feishu-bot-task` without pinning a specific package version. This can cause users to fetch and execute a newer or compromised package at install time, creating a supply-chain risk if the upstream package is altered or hijacked.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The command `npx skills add https://github.com/lixiang92229/feishu-bot-task -y -g` relies on unpinned remote resolution and may pull changing code from a GitHub repository. If the repo is compromised or later modified, users may execute unintended code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The Chinese installation section repeats the unpinned `npx clawhub` installation pattern, exposing the same mutable-package execution risk. Duplicating the unsafe instruction increases the chance that users will follow it.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The Chinese GitHub-based `npx skills add` command points to an unpinned repository target, allowing remote code changes to affect later installs. This is a supply-chain hazard because installation behavior is not tied to a fixed artifact.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares it requires environment credentials and makes direct API calls, but it does not define any explicit tool scope such as allowed-tools or permissions. That weakens containment and reviewability by leaving access to sensitive capabilities like network use and secret-backed execution implicit rather than narrowly constrained.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file describes behavior that accesses sensitive environment variables (`FEISHU_APP_ID` / `FEISHU_APP_SECRET`). While it states that credentials are read automatically, it does not explicitly warn users that the skill will use sensitive secrets from the environment or advise caution when running it in shared contexts.

Static analysis

No suspicious patterns detected.