ClawHub
Back to skill

Security audit

Feishu Integration

Security checks for vulnerabilities and agentic risk

Overview

This Feishu integration mostly matches its stated purpose, but it ships a plaintext app secret and handles bearer tokens in ways that need review before use.

Do not use this skill as-is with real tenant privileges. Rotate the exposed Feishu app secret, replace config/feishu.env with a template, restrict the Feishu app scopes, harden token caching to private 0600 files or a secret store, validate authenticated request destinations, and update vulnerable dependencies before installing or running cron automation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
config/feishu.env:4
Finding
Committed Feishu Application Secret<![CDATA[ ## Vulnerability Details **File Location**: `config/feishu.env:4-5` **Vulnerability Type**: Hardcoded production credential **Risk Level**: Critical ### Vulnerable Code ```bash FEISHU_APP_ID=cli_a90da2f009f8dbb3 FEISHU_APP_SECRET=[REDACTED ACTIVE SECRET] ``` The actual source file contains a plaintext secret. Its value is redacted from this report to avoid further credential exposure. ### Technical Analysis A Feishu application secret is committed directly to the project configuration. This contradicts the warning in the same file that sensitive information must not be committed. The credential is consumed by `scripts/feishu-auth.sh` and transmitted to Feishu's official tenant-token endpoint: ```bash response=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{ \"app_id\": \"${FEISHU_APP_ID}\", \"app_secret\": \"${FEISHU_APP_SECRET}\" }") ``` Possession of both the application ID and application secret can allow an unauthorized party to obtain a tenant access token. The resulting privileges depend on the permissions granted to the Feishu application. This network transmission is necessary for Feishu authentication and targets the official HTTPS endpoint. The vulnerability is not the transmission itself, but the inclusion of the secret in the distributed project. ### Attack Path 1. An attacker obtains the repository, Skill package, artifact, backup, or historical commit. 2. The attacker extracts the Feishu application ID and secret from `config/feishu.env`. 3. The attacker submits those credentials to Feishu's tenant access-token endpoint. 4. Feishu returns a tenant token if the credential remains valid. 5. The attacker invokes APIs enabled for the application, potentially including message, document, drive, wiki, OCR, or group operations. ### Impact Assessment The attacker may receive the same application-level privileges that Feishu grants t ...[truncated 470 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed Feishu application secret immediately. 2. Review Feishu audit logs for token issuance and API activity associated with the application. 3. Remove the secret from the current tree and all repository history. 4. Replace `config/feishu.env` with a non-sensitive template such as: ```bash FEISHU_APP_ID= FEISHU_APP_SECRET= ``` 5. Add actual credential files to `.gitignore` and distribution exclusion rules. 6. Load production credentials from a protected environment variable, operating-system credential store, or centralized secret manager. 7. Restrict the Feishu application to only the scopes required by the enabled features. 8. Add automated secret scanning to pre-commit and CI workflows. 9. Rotate the secret again after repository-history cleanup if copies may already have been distributed. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/feishu-auth.sh:48
Finding
Tenant Tokens Stored in Predictable Files Without Explicit Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-auth.sh:9, 48-53` **Additional Locations**: `reference-feishu-common/index.js:8, 71-74, 89-93`; `reference-feishu-message/get.js:9, 14-16, 30-33` **Vulnerability Type**: Unsafe plaintext token caching and predictable temporary file usage **Risk Level**: High ### Vulnerable Code The shell implementation uses a fixed, globally predictable path: ```bash CACHE_FILE="/tmp/feishu_token_cache.json" ``` It writes the bearer token without first establishing restrictive permissions or safely creating the file: ```bash cat > "$CACHE_FILE" << EOF { "token": "${token}", "expiry_time": ${expiry_time} } EOF ``` The JavaScript helper similarly stores a plaintext bearer token without an explicit file mode: ```javascript const TOKEN_CACHE_FILE = path.resolve(__dirname, '../../memory/feishu_token.json'); const cacheData = { token: data.tenant_access_token, expire: now + data.expire }; const cacheDir = path.dirname(TOKEN_CACHE_FILE); if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true }); fs.writeFileSync(TOKEN_CACHE_FILE, JSON.stringify(cacheData, null, 2)); ``` The message implementation also reads and writes the same style of cache: ```javascript const TOKEN_CACHE_FILE = path.resolve(__dirname, '../../memory/feishu_token.json'); if (fs.existsSync(TOKEN_CACHE_FILE)) { const cached = JSON.parse(fs.readFileSync(TOKEN_CACHE_FILE, 'utf8')); if (cached.expire > now + 60) return cached.token; } ``` ### Technical Analysis Tenant access tokens are bearer credentials: any process that acquires a valid token can exercise its associated permissions without separately knowing the application secret. The shell cache is especially exposed because it uses a fixed filename in the shared `/tmp` namespace. The script does not: - Set a restrictive `umask`. - Create the file with mode `0600`. - Verify file ownership. - Reject symbolic links. - Use an atomic, securely created tempor ...[truncated 2336 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Store caches in a private per-user directory rather than a shared `/tmp` filename. 2. Create the directory with mode `0700` and verify that it is owned by the current user. 3. Set `umask 077` before creating credential-bearing files. 4. Create cache files atomically with mode `0600`. 5. Refuse to read or overwrite symbolic links and validate file ownership before trusting cached data. 6. Write to a securely created temporary file in the same directory, flush it, and atomically rename it into place. 7. Apply equivalent hardening to all JavaScript token-cache implementations. 8. Prefer an operating-system keyring or secret manager where available. 9. Delete expired cache files and avoid sharing a single cache across users or tenants. 10. Never run the current shared-`/tmp` implementation as root or another privileged service account. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
reference-feishu-common/index.js:104
Finding
Authenticated Fetch Helper Sends Feishu Bearer Tokens to Unrestricted URLs<![CDATA[ ## Vulnerability Details **File Location**: `reference-feishu-common/index.js:104-110, 130-132` **Vulnerability Type**: Unrestricted credential forwarding **Risk Level**: High ### Vulnerable Code ```javascript async function fetchWithAuth(url, options = {}) { let token = await getToken(); let headers = { ...options.headers, 'Authorization': `Bearer ${token}` }; try { let res = await fetchWithRetry(url, { ...options, headers }); ``` The retry path repeats the same behavior: ```javascript token = await getToken(true); headers = { ...options.headers, 'Authorization': `Bearer ${token}` }; return await fetchWithRetry(url, { ...options, headers }); ``` ### Technical Analysis `fetchWithAuth` is exported as a shared helper and accepts an arbitrary URL. It obtains a Feishu tenant access token and unconditionally inserts that token into the `Authorization` header. The function does not validate: - The URL scheme. - The destination hostname. - Whether the destination is an approved Feishu API endpoint. - Whether a redirect changes the request destination. Consequently, any dependent code that passes an attacker-controlled, misconfigured, or non-Feishu URL can disclose the bearer token to that destination. The current audited callers predominantly use official Feishu endpoints, so exploitation requires a dependent caller or future extension to pass an unsafe URL. Nevertheless, the exported security primitive itself violates destination-bound credential handling. ### Attack Path 1. A dependent Skill imports `fetchWithAuth`. 2. The dependent Skill constructs the destination from user input, remote data, or configuration. 3. An attacker supplies an HTTPS URL under their control. 4. `fetchWithAuth` obtains a valid Feishu tenant token. 5. The helper adds `Authorization: Bearer <token>` to the request. 6. The attacker-controlled server records the authorization header. 7. The attacker reuses the token against Feishu before expiration ...[truncated 627 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Parse the URL before adding credentials: ```javascript const parsed = new URL(url); if (parsed.protocol !== 'https:' || parsed.hostname !== 'open.feishu.cn') { throw new Error('Authenticated requests are restricted to open.feishu.cn'); } ``` 2. Consider restricting the path to `/open-apis/` as an additional control. 3. Disable automatic cross-origin redirects or validate every redirect destination before forwarding authorization headers. 4. Separate generic network fetching from Feishu-authenticated fetching. 5. Prefer API methods that accept relative Feishu paths rather than complete URLs. 6. Add tests proving that HTTP URLs, deceptive subdomains, alternate ports, and non-Feishu hosts are rejected. 7. Document that the authenticated helper must never be used for arbitrary user-supplied URLs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/group-welcome.py:175
Finding
Group Welcome Module Reads All Values from a Shared OpenClaw Credential File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/group-welcome.py:175-203` **Vulnerability Type**: Excessive credential-file access **Risk Level**: Medium ### Vulnerable Code ```python def load_env_config() -> Dict[str, str]: """ 从 ~/.openclaw/.env 文件读取配置 Returns: 配置字典 """ env_path = Path.home() / '.openclaw' / '.env' config = {} if env_path.exists(): with open(env_path, 'r', encoding='utf-8') as f: for line in f: line = line.strip() # 跳过空行和注释 if line and not line.startswith('#') and '=' in line: key, value = line.split('=', 1) config[key.strip()] = value.strip().strip('"\'') return config # 加载环境配置 ENV_CONFIG = load_env_config() ``` The function subsequently needs only the Feishu application values: ```python app_id = os.getenv("FEISHU_APP_ID") or ENV_CONFIG.get("FEISHU_APP_ID") app_secret = os.getenv("FEISHU_APP_SECRET") or ENV_CONFIG.get("FEISHU_APP_SECRET") ``` ### Technical Analysis The group welcome functionality requires only `FEISHU_APP_ID` and `FEISHU_APP_SECRET`, but the module reads every key and value from the shared `~/.openclaw/.env` file into an in-memory dictionary. The read occurs at module import time through: ```python ENV_CONFIG = load_env_config() ``` This behavior exceeds the minimum credential access necessary for the declared welcome-bot functionality. A shared OpenClaw environment file may contain credentials for unrelated services. Loading those values expands the sensitive-data exposure of this process and any imported Python dependencies. No evidence in the audited code shows these unrelated values being transmitted over the network. The issue is excessive local access and increased exposure, not confirmed exfiltration. ### Attack Path 1. A user executes or imports `group-welcome.py`. 2. Module initialization opens `~/.openclaw/.env`. 3. Every parseable key ...[truncated 1001 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the import-time loading of the shared `~/.openclaw/.env` file. 2. Prefer protected process environment variables for only: ```text FEISHU_APP_ID FEISHU_APP_SECRET ``` 3. If a file is required, use a dedicated Feishu configuration file with mode `0600`. 4. Parse only an explicit allowlist of required keys instead of retaining every value. 5. Load credentials lazily only when authentication is requested. 6. Avoid storing unrelated secrets in a module-global dictionary. 7. Validate ownership and permissions before reading any credential file. 8. Document the exact credential sources and ensure the welcome bot account has only the Feishu scopes needed to list members and send messages. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (110)

Tainted flow: 'app_id' from os.getenv (line 253, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
try:
        url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
        resp = requests.post(
            url,
            json={"app_id": app_id, "app_secret": app_secret},
            timeout=REQUEST_TIMEOUT
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High
Category
Privilege Escalation
Content
}

/**
 * Get Tenant Access Token (Cached)
 */
async function getToken(forceRefresh = false) {
    const now = Math.floor(Date.now() / 1000);
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
The lockfile pins axios 1.13.5, which the static analysis reports as having multiple known advisories including SSRF/proxy bypass and prototype-pollution-related request/response manipulation issues. In a shared HTTP helper package, axios is likely a core dependency, so exploitable HTTP client bugs can affect any consumer that makes outbound requests with attacker-influenced URLs, proxy settings, or request configuration.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
93% confidence
Finding
form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If any consuming code builds multipart requests from attacker-controlled input, this can let an attacker smuggle or alter multipart headers/content, potentially leading to request tampering against upstream services.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The package permits installation of axios 1.13.5 via the caret range, and the analyzer reports that version as having multiple known advisories including SSRF-related and prototype-pollution-adjacent issues. This is especially concerning in a Feishu API client and authentication utility because HTTP request handling and credential-bearing traffic are core functions, so exploitation could affect tokens, outbound request routing, or response integrity.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
const path = require('path');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env') });

// Try to load Lark SDK
let Lark;
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
axios 1.13.4 is directly depended on and the scanner reports multiple high-severity advisories, including SSRF/proxy bypass and prototype-pollution-related attack chains. In a messaging/integration skill that likely makes outbound HTTP requests, a vulnerable HTTP client is especially relevant because attacker-controlled URLs, redirects, headers, or proxy settings can turn these issues into credential leakage, request forgery, or traffic interception.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
89% confidence
Finding
form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names/filenames. In a skill that likely uploads files or posts multipart requests to Feishu or other APIs, attacker-controlled field metadata could poison outbound requests, alter multipart structure, or inject unintended headers/content.

Known Vulnerable Dependency: music-metadata==11.11.2 — 1 advisory(ies): CVE-2026-32256 (music-metadata has an infinite loop vulnerability in ASF parser)

High
Category
Supply Chain
Confidence
92% confidence
Finding
music-metadata 11.11.2 is directly depended on and is reported to contain an infinite-loop vulnerability in ASF parsing. If this skill accepts or inspects user-supplied audio/media, a crafted file could hang the process or consume CPU, making the issue highly relevant in this context.

Known Vulnerable Dependency: protobufjs==7.5.4 — 12 advisory(ies): CVE-2026-44294 (protobuf.js: Denial of service from crafted field names in generated code); CVE-2026-44293 (protobuf.js: Code injection through bytes field defaults in generated toObject c); CVE-2026-44289 (protobuf.js: Denial of service through unbounded protobuf recursion) +9 more

High
Category
Supply Chain
Confidence
84% confidence
Finding
protobufjs 7.5.4 is present transitively through the Feishu SDK and the scanner reports multiple high-severity issues including denial of service and code-generation-related injection risks. Even if some advisories only apply when using code generation features, the package version is vulnerable and protobuf parsing of untrusted data could expose the application to resource exhaustion or unsafe generated output paths.

Known Vulnerable Dependency: qs==6.14.1 — 3 advisory(ies): GHSA-4mjr-xmp4-gh2g; GHSA-q8mj-m7cp-5q26; GHSA-w7fw-mjwx-w883

High
Category
Supply Chain
Confidence
80% confidence
Finding
qs 6.14.1 is included transitively and is associated with multiple high-severity advisories, commonly around prototype pollution or unsafe querystring parsing behaviors. In an API integration skill, parsing attacker-controlled query strings or merging parsed objects into config/state can enable object pollution and downstream exploitation.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): GHSA-58qx-3vcg-4xpx; GHSA-96hv-2xvq-fx4p

High
Category
Supply Chain
Confidence
80% confidence
Finding
ws 8.19.0 is present transitively through the Feishu SDK and is flagged by the scanner with high-severity advisories. If the SDK opens WebSocket connections or processes attacker-influenced frames/handshakes, vulnerabilities in ws can expose the process to denial of service, data exposure, or protocol-level abuse depending on the specific advisory conditions.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): GHSA-35jp-ww65-95wh; GHSA-3g43-6gmg-66jw; GHSA-3p68-rc4w-qgx5 +13 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
The project declares axios with a version range that static analysis associates with a known vulnerable resolved version. Because this skill performs Feishu message operations and likely makes outbound HTTP requests, a vulnerable HTTP client can expose the skill to request smuggling, SSRF-related bypasses, header handling issues, or other library-specific flaws depending on which advisories apply.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
84% confidence
Finding
form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. In a messaging or file-upload skill, if any multipart field names or metadata can be influenced by external input, this could enable malformed requests, header injection, or abuse of downstream services that parse multipart bodies.

Known Vulnerable Dependency: music-metadata==11.11.2 — 1 advisory(ies): CVE-2026-32256 (music-metadata has an infinite loop vulnerability in ASF parser)

High
Category
Supply Chain
Confidence
81% confidence
Finding
music-metadata 11.11.2 is reported vulnerable to an infinite loop in the ASF parser, creating a denial-of-service risk when parsing crafted media files. This package is especially relevant in a message-processing skill because attachments or uploaded audio/media may be attacker-controlled, making parser-level DoS more plausible in context.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# 删除缓存强制刷新
rm /tmp/feishu_token_cache.json

# 或调用刷新命令
bash feishu-auth.sh refresh
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
reference-feishu-message/index.js:17

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
reference-feishu-message/send.js:23

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
reference-feishu-common/index.js:6

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
reference-feishu-message/get_latest_file.js:6

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
reference-feishu-message/get.js:7

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
reference-feishu-message/send-audio.js:10

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
reference-feishu-common/index.js:73

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
reference-feishu-message/get_latest_file.js:15

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
reference-feishu-message/get.js:14

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
reference-feishu-message/send-audio.js:23