ClawHub
Back to skill

Security audit

Feishu Agent Team

Security checks for vulnerabilities and agentic risk

Overview

This Feishu coordinator skill appears purpose-aligned, but it can process, persist, and pass group chat content between agents without enough prominent scoping for users.

Install only if you are comfortable with configured Feishu group messages being handled by multiple agents and potentially stored in checkpoints or logs. Review the configuration paths, limit the allowed groups, avoid sending secrets in routed chats, and look for retention or redaction controls before enabling it broadly.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill metadata declares only the command requirement `python3`, but the documented behavior clearly involves reading local configuration files such as `config/team.yaml`, bindings, and other workspace files. Undeclared file-read capability weakens the permission model and can mislead users or reviewers about what data the skill can access, which matters because this skill processes chat-driven tasks and persists state.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill routes Feishu group messages that @mention the coordinator to other agents, but the top-level description does not clearly warn users that group content will be received, processed, persisted, and redistributed across multiple agents/processes. In a chat-integration skill, insufficient disclosure increases the risk of accidental sharing of sensitive business, personal, or internal information beyond what users expect.

Static analysis

No suspicious patterns detected.