ClawHub
Back to skill

Security audit

my-lark

Security checks for vulnerabilities and agentic risk

Overview

This Feishu/Lark skill is broadly purpose-aligned, but it embeds app credentials and requests wide business-account access without adequate safeguards or disclosure.

Review carefully before installing. Do not use this version with real Feishu credentials until the embedded App Secret is removed and rotated, the token file handling is secured, dependency versions are pinned, and destructive or public actions require explicit confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
lark_mcp.py:10
Finding

Hardcoded Feishu Application Credentials Exposed in Source Code and Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
lark_mcp.py:13
Finding

Plaintext Token Storage Without Enforced Restrictive File Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:117
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (38)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description substantially overstates the implemented functionality. While the wrapper can call arbitrary lark-mcp tools through a generic call path, the provided code chunk itself only demonstrates a small set of Feishu operations and does not evidence broad built-in support for all listed modules. The primary behavior is a technical API/CLI wrapper, not a full-featured beginner-friendly 'all capabilities' skill with guided flows and comprehensive module coverage. Additionally, the code hardcodes Feishu app credentials and persists user tokens locally, which is an implementation capability/sensitivity not declared in the description.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly centers around access tokens and earlier instructs users to store app_id, app_secret, and user_access_token in a predictable local file path under /workspace. In a multi-tool agent environment, predictable credential locations materially increase the risk of unauthorized credential access, token reuse, and broad compromise of messaging, documents, contacts, approvals, and other enterprise data.

Content

Scanner excerpt · SKILL.md (reported line 466)May include surrounding context.

md
| 凭证 | 有效期 | 获取方式 | 用途 |
|------|-------|---------|------|
| App Token（tenant_access_token）| 2小时，自动续期 | app_id + app_secret 自动换取 | 消息/日历/通讯录/审批/多维表格/云盘 |
| User Access Token | 2小时 | OAuth 用户授权 | 知识库/云文档搜索和读取 |

### 权限申请自查表（按功能）

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file contains hardcoded Feishu app credentials, which are secrets that can be extracted by anyone with access to the code or logs. Because the script actively transmits them to an external CLI for authenticated API access, compromise of the code directly enables unauthorized use of the associated Feishu application and its permissions.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · lark_mcp.py (reported line 30)May include surrounding context.

python
"""通过 lark-mcp CLI 调飞书官方 MCP 工具（App Token）"""
    if arguments is None:
        arguments = {}
    env = os.environ.copy()
    env.pop("npm_config_prefix", None)
    cmd = ["lark-mcp", "mcp",
           "--app-id", APP_ID, "--app-secret", APP_SECRET,

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The script loads a persistent user access token from a local file and uses it for authenticated API actions without any visible protection, encryption, or permission hardening. In the context of a broad Feishu automation skill that can read documents, search content, and send messages, token theft or misuse would provide direct access to user data and actions as that user.

Content

Scanner excerpt · lark_mcp.py (reported line 60)May include surrounding context.

python
直接调用飞书 Open API
    :param method: GET/POST/PUT/DELETE
    :param path: API 路径，如 /im/v1/messages
    :param token: User Access Token（留空则用文件中的）
    :param json_data: POST body dict
    :param params: URL query params dict
    """

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 20)May include surrounding context.

md
| 凭证类型 | 获取方式 | 有效期 | 用途 |
|---------|---------|--------|------|
| App Token（tenant_access_token）| 自动用 app_id + app_secret换取 | 2小时，自动续期 | 大多数 API |
| User Access Token | OAuth 用户授权流程 | 2小时，可刷新 | 知识库、云文档搜索 |

## 凭证与工具对照

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth.md (reported line 59)May include surrounding context.

md
## API 错误码

0 - 成功
99991663 - Access Token 无效或过期
99991400 - 参数错误
99991403 - 权限不足
99991140 - 接口调用频率超限

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/errors.md (reported line 6)May include surrounding context.

md
## API 错误码

0 - 成功
99991663 - Access Token 无效或过期
99991400 - 参数错误
99991403 - 权限不足
99991140 - 接口调用频率超限

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents broad capabilities that include shell execution, file access, network access, and credential file handling, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, this omission increases the chance that the skill can invoke powerful primitives without transparent least-privilege boundaries, enabling unauthorized data access, modification, or transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are extremely broad, covering common user intents like sending messages, searching documents, and listing groups, without clear activation boundaries or confirmation requirements. In an agent setting, this can cause accidental invocation of sensitive read/write actions, especially for messaging, document access, and directory lookups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises write-capable and privacy-impacting operations such as sending messages, reading documents, accessing contacts, calendars, approvals, and drive content, but it does not provide user-facing warnings or consent guidance. This is dangerous because users or higher-level agents may trigger sensitive enterprise actions without realizing data will be modified or personal/corporate information accessed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

  1. 浏览器打开 → 扫码授权 → 回调获取 code
  2. 用 code 换取 token：
bash
curl -X POST 'https://open.feishu.cn/open-apis/authen/v1/oidc/access_token' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer USER_ACCESS_TOKEN' \
  -d '{"grant_type": "authorization_code", "code": "获取的code"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The subprocess command explicitly sets "--language", "zh", which imposes a specific language setting. This is a natural-language policy concern because the script does not offer the user any locale choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · lark_mcp.py (reported line 35)May include surrounding context.

python
cmd = ["lark-mcp", "mcp",
           "--app-id", APP_ID, "--app-secret", APP_SECRET,
           "--language", "zh", "--mode", "stdio"]
    proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE, env=env)
    init = {"jsonrpc":"2.0","id":1,"method":"initialize",
            "params":{"protocolVersion":"2024-11-05","capabilities":{},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The feishu_api wrapper performs outbound HTTP requests with an Authorization bearer token and is used for actions such as sending messages, searching documents, and reading document contents. While helper docstrings describe functionality, there is no explicit user-facing warning or confirmation that user content and identifiers may be transmitted to Feishu APIs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The generic call command exposes arbitrary MCP tool invocation, bypassing the narrower, user-guided interface described by the skill. In this context, that broadens capability to any available Feishu-connected tool operation, increasing the risk of unauthorized data access or side-effecting actions beyond expected user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file documents safety-relevant actions such as submitting an approval instance and performing approval operations including instance cancellation, but it does not warn users that these actions can change business workflow state or be difficult to undo. For markdown files, omissions of warnings about behaviors affecting user data or system/process integrity should be flagged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents creating events and lists update/delete CRUD operations, which can affect user data and calendar integrity. The description contains no warning or caution about these state-changing actions, despite SQP-2 requiring user-facing disclosure for behaviors that may affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing safety disclosures. The file documents create, update, delete, and import capabilities for cloud documents, but provides no warning that these actions can alter or remove user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file lists file operations including delete alongside move, copy, and rename, but provides no warning that these actions can affect or remove user data. Under the markdown-specific SQP-2 criteria, skill descriptions should disclose behaviors that may impact user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documented scope grants the ability to view, comment, edit, and manage all files in cloud storage, which has significant privacy and integrity implications. The markdown does not warn users that enabling this scope allows access to all files, so it lacks the disclosure expected for sensitive data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file documents actions that can send messages, recall messages, manage groups, and upload files, all of which can affect user data, privacy, or communication integrity. The description provides direct invocation examples and capability listings but does not include any warning or disclosure about these potentially impactful behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes a direct example for writing cell values via sheets_v2_spreadsheets_values_put, which can alter user data in a spreadsheet. The description provides no caution, confirmation note, or warning about overwriting existing content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-start instructs users to print the contents of ~/.lark_tokens.json directly to the terminal, which can expose app credentials or tokens to shoulder-surfing, terminal logs, shell history capture, or recorded sessions. In a setup guide for a messaging/document platform skill, credential disclosure is especially risky because the same credentials may permit broad API access across chat, docs, drive, calendar, and directory features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example authentication request embeds app_secret inline without any warning about secret handling, encouraging users to place secrets directly in command lines where they may be stored in shell history, process listings, CI logs, or shared transcripts. Because this skill is intended for easy copy-paste use by beginners, the likelihood of unsafe secret handling is higher than in expert-only documentation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:111