T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/feishu-setup.md:66- Finding
Overprivileged Feishu Permission Bundle Violates Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw多智能体创建向导
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its setup-wizard purpose, but it asks users to paste Feishu secrets into chat and recommends broad permissions and persistent agent-profile writes without enough safeguards.
Review this skill carefully before installing. Do not paste Feishu App Secrets into chat; enter secrets only through a local masked prompt, environment variable, or trusted secret store. Reduce Feishu permissions to the minimum needed for message receive/send and routing, and run the starter-profile writer only on new empty workspaces or after backing up existing agent files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
references/feishu-setup.md:43- Finding
Feishu App Secret Is Explicitly Collected Through AI Conversation History
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/write_starter_profile.py:281- Finding
Starter Profile Generator Unconditionally Overwrites Persistent Agent State
- Content
View full analysis
list[Path]: role = ROLE_DATA.get(kind, ROLE_DATA["generic"]) files = { "IDENTITY.md": build_identity(name, role["jobs"]), "SOUL.md": build_bullets("SOUL", role["soul"]), "AGENTS.md": build_agents_doc(name, role["agents"]), "MEMORY.md": build_bullets("MEMORY", role["memory"]), "TOOLS.md": build_bullets("TOOLS", role["tools"]), "USER.md": build_bullets("USER", role["user"]), } written = [] for filename, content in files.items(): path = workspace / filename path.write_text(content, encoding="utf-8") written.append(path) return written ``` The compatibility wrapper invokes the same unsafe operation at `scripts/write_identity_template.py:24-26`: ```python workspace = Path(args.workspace) workspace.mkdir(parents=True, exist_ok=True) written = write_bundle(workspace, args.name, args.kind) ``` ### Technical Analysis `Path.write_text()` truncates and replaces an existing file. The generator does not check whether any target file already exists, does not verify that the workspace belongs to a newly created agent, does not create backups, and does not require an explicit overwrite flag. The six affected files contain persistent identity, behavioral, memory, tool, and user-profile instructions. Replacing them can alter future agent behavior and destroy carefully customized state. This implementation also conflicts with the Skill's documented policy to preserve existing configurations and agent data. ### Attack Path 1. The script is invoked with an existing workspace path, whether through operator error, workspace confusion, or maliciously supplied input. 2. The workspace directory already contains one or more customiz ...[truncated 610 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
scripts/write_starter_profile.py:244- Finding
Unsanitized Agent Name Enables Persistent Instruction Injection
- Content
View full analysis
str: return "\n".join( [ f"# {name}", "", f"You are {name}.", "", "Your main job:", f"- {jobs[0]}", f"- {jobs[1]}", f"- {jobs[2]}", "", "Your style:", "- clear", "- practical", "- friendly", "", "When you are unsure, ask a short clarifying question instead of guessing.", "", ] ) def build_bullets(title: str, items: list[str]) -> str: lines = [f"# {title}", ""] lines.extend(f"- {item}" for item in items) lines.append("") return "\n".join(lines) def build_agents_doc(name: str, items: list[str]) -> str: lines = ["# AGENTS", "", f"This workspace belongs to {name}.", ""] lines.extend(f"- {item}" for item in items) lines.append("") return "\n".join(lines) ``` The unvalidated value originates from `scripts/write_starter_profile.py:304-312`: ```python parser = argparse.ArgumentParser() parser.add_argument("--workspace", required=True) parser.add_argument("--name", required=True) parser.add_argument("--kind", default="generic", choices=sorted(ROLE_DATA.keys())) args = parser.parse_args() workspace = Path(args.workspace) workspace.mkdir(parents=True, exist_ok=True) written = write_bundle(workspace, args.name, args.kind) ``` ### Technical Analysis The user-controlled `--name` value is interpolated verbatim into `IDENTITY.md` and `AGENTS.md`. No validation rejects newline characters, control characters, Markdown structure, or instruction-like content. An attacker can provide a multiline display name that closes the intended heading or sentence and appends arbitrary b ...[truncated 1400 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill should guide beginners through OpenClaw multi-agent setup with a step-by-step wizard, including creating multiple agents and Feishu channel bindings. The supplied code does none of that. It is a narrow helper script that accepts agent display names and outputs JSON containing suggested unique agent IDs. It neither orchestrates setup nor interacts with OpenClaw configuration, Feishu, or any wizard interface. This is a materially different primary purpose, so it is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill guides beginners through OpenClaw multi-agent setup, including multiple agents and Feishu bindings. The supplied code does none of that. It only accepts one or more agent display names as CLI arguments, applies keyword-based rules to suggest a persona kind such as product, engineering, or data, and prints the result as JSON. This is materially different from the declared primary purpose and lacks the described setup, wizard, and integration behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description says this skill guides beginners through OpenClaw multi-agent setup with step-by-step help and Feishu bindings. The supplied code instead defines a small CLI script that accepts workspace/name/kind arguments, creates the workspace directory, calls write_bundle from another module, and prints JSON about the files written. Its observed behavior is profile/bundle file generation, not an interactive setup wizard or multi-agent/Feishu configuration workflow. This is a clear material mismatch in primary purpose and capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill guides beginners through OpenClaw multi-agent setup with a step-by-step wizard, including creating multiple agents and Feishu bindings. The supplied code does not implement any wizard, conversational guidance, multi-agent orchestration setup, or Feishu integration. Instead, it is a command-line utility that writes a predefined set of markdown profile files into a workspace for one agent role. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # OpenClaw Multi-Agent Wizard A beginner-friendly Codex/OpenClaw skill that helps users create OpenClaw multi-agent setups step by step, with a strong focus on simple explanations, Feishu onboarding, and safe defaults. ## GitHub Description
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs the agent to inspect local environment state, modify configs, write files, restart services, and guide Feishu integration, which implies file-write and network/system capabilities. Omitting an explicit tool scope or permissions declaration increases the chance the skill runs with broader-than-necessary access and makes it harder to review what authority it should have.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Soliciting sensitive credentials directly in the conversational workflow normalizes insecure secret handling and exposes the App Secret to transcript retention, debugging logs, prompt injection side effects, or unintended downstream tool access. Because this skill is an onboarding wizard for beginners, users are especially likely to follow the unsafe instruction without understanding the exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill tells the agent to have the user paste Feishu App ID and App Secret directly into chat, but provides no warning, masking guidance, or secure collection channel. Secrets entered into chat may be logged, retained, exposed to other tools, or leaked through transcripts, creating credential-compromise risk for the Feishu integration.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill enables implicit invocation but provides no visible trigger constraints, narrowing logic, or safety gating in this file. That means the platform may auto-activate the wizard based on broad user intent matching, which can cause the agent to take configuration-oriented actions unexpectedly or in the wrong context, increasing the chance of unintended setup changes or social-engineering-assisted misuse.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Wizard behavior: 1. choose a safe agent ID 2. create the agent with an explicit workspace when possible 3. verify with `openclaw agents list` ### Identity branch
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly tells the operator to collect Feishu App ID and App Secret and to place them into configuration examples, but it does not warn about secret handling, secure storage, redaction in logs, or avoiding plaintext sharing through the chat wizard. In an agent-assisted setup flow, this increases the risk that users paste credentials into unsafe channels, store them in world-readable files, or expose them through logs and transcripts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The dialogue says 'I'll start it first,' implying the skill can initiate a gateway service rather than merely guide the user. That creates a capability expectation mismatch: users may authorize or trust system-modifying actions the skill was only described as explaining, which can lead to unsafe automation boundaries and unintended operational changes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script states the assistant will create agents and write role files, which implies direct file/configuration changes beyond the manifest's beginner-friendly guidance framing. This can mislead users about the trust boundary and increases the risk of unauthorized or poorly reviewed modifications to agent behavior and local configuration.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script explicitly instructs users to paste a Feishu App Secret into chat and says the assistant will 'handle the OpenClaw side.' This exceeds a beginner-guidance role and normalizes collection of sensitive credentials through conversational channels, creating a direct risk of secret exposure, retention, or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Requesting that a user paste an App Secret into chat without any warning or secure-handling instructions is an unsafe secret collection pattern. Secrets shared in conversation may be logged, retained, exposed to other tools, or copied into prompts, making compromise of the Feishu app materially more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script directly instructs users to paste App ID and App Secret into the chat, which is a classic sensitive-data exposure issue. In this context, the skill targets beginners, making it more dangerous because inexperienced users are more likely to comply and less likely to understand the persistence and distribution risks of sharing credentials in-chat.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the user to paste the Feishu App Secret into the chat, causing a sensitive credential to be disclosed to the agent/runtime. Even if intended for convenience, this exceeds the minimum need of a setup wizard and creates a real risk of secret capture in logs, transcripts, prompt history, telemetry, or downstream tooling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instructions request App ID and App Secret with no security warning or handling guidance. This normalizes unsafe secret-sharing behavior and increases the chance that valid credentials are exposed through conversation history or copied into insecure places during onboarding.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md # Persona Templates Write a very short starter profile for each new agent so the user does not get an empty shell. ## Rules
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The helper examples and default mappings use Chinese agent names such as '产品助理' and '数据助理', and the suggested workflow/default behavior is framed around those names. The file does not explicitly offer users a language or locale choice or explain that this locale-specific convention is optional, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document presents key workflow options using Chinese labels (
多 bot 多 agent,单 bot 多 agent) as the primary names, but it does not offer an English alternative, user language selection, or a justification for requiring Chinese terminology. This can violate language/locale policy because users may be forced into a specific language context without opt-in.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md If the agent name already strongly suggests a role: - infer the starter persona kind automatically - do not ask the user to choose unless the name is ambiguous - for A2A worker names, also recognize obvious specialist roles like `data`, `writing`, `project`, and `research` ## The one sentence promise
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The troubleshooting guidance explicitly tells the agent to start or restart the gateway, which is a system-affecting action, without requiring user confirmation or clearly warning that a local service will be modified. In an agent skill, this can lead to unauthorized operational changes, surprise service disruption, or execution in the wrong environment if the agent acts automatically.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instruction says to try starting the gateway automatically if a status check fails, but it does not require notifying the user or obtaining confirmation first. In a beginner-oriented setup wizard, this can trigger an unexpected local service state change, which may have side effects such as opening ports, consuming resources, or modifying runtime state without the user's explicit approval.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file instructs the agent to inspect local logs or state during troubleshooting without disclosing that this may access potentially sensitive local application data. Even if done for legitimate debugging, silent log/state inspection can expose secrets, message contents, identifiers, or configuration details beyond what the user expects.
- Content