Feishu Send Message

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:48 PM UTC
• Version: 1.0.5

Overview

This Feishu messaging skill mostly does what it says, but it can use local Feishu credentials to send automatic outbound messages without enough scoping or safeguards.

Review before installing. Only use it if this agent should be allowed to read its Feishu app credentials and send messages externally. Do not enable the automatic message.received hook unless you add sender allowlists, rate limits, loop prevention, and message-review rules. Keep the OpenClaw config file locked down, use least-privilege Feishu app scopes, and patch the script to validate msg_type and JSON-encode target/message values safely.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: send.sh:62

Finding

Untrusted Arguments Are Interpolated into JSON Without Escaping

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Use `jq` to encode the nested content and outer request instead of manually concatenating JSON: ```bash CONTENT=$(jq -cn --arg text "$MESSAGE" '{text: $text}') PAYLOAD=$(jq -cn \ --arg receive_id "$TARGET" \ --arg content "$CONTENT" \ '{receive_id: $receive_id, msg_type: "text", content: $content}') RESULT=$(printf '%s' "$PAYLOAD" | curl -sS --fail-with-body \ -X POST \ --get \ --data-urlencode "receive_id_type=$MSG_TYPE" \ "https://open.feishu.cn/open-apis/im/v1/messages" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ --data-binary @-) ``` 3. Validate target identifiers against the expected Feishu identifier syntax and impose reasonable length limits. 4. Treat all hook-derived values as untrusted, even when supplied by the OpenClaw event system. 5. Use `curl -sS --fail-with-body` and explicitly handle transport failures and non-success HTTP status codes. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: send.sh:49

Finding

Feishu App Secret and Access Token Are Exposed in Process Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest claims the skill can be used immediately and that the agent will automatically scan and invoke it at startup, without defining strict trigger conditions or approval boundaries. In a messaging skill that reads credentials and can send outbound messages, broad auto-invocation language increases the risk of unintended message dispatch, misuse by other prompts, and confused-deputy behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the agent will automatically reply after receiving a message, but does not define message source validation, scope, or rate/loop protections. For an agent-connected messaging integration, this can cause unsolicited outbound communication, reply loops, or abuse by any party able to send triggering messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents configuring a message.received hook to automatically invoke send.sh and send outbound Feishu replies. That creates autonomous outbound messaging behavior without any warning about consent, privacy implications, reply loops, spam risk, or the fact that incoming sender identifiers may be reused for automatic response, making misuse or accidental data leakage more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The direct API examples instruct readers to extract appSecret from a local config file and send it to an external endpoint to obtain a tenant token, but provide no warning about handling sensitive credentials, storage permissions, shell history/logging exposure, or network egress. In a skill meant for agent automation, that omission increases the chance operators expose secrets or normalize unsafe credential handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This example performs external transmission of the Feishu App Secret to Feishu's token endpoint. Although contacting the legitimate service is necessary for functionality, the skill context matters: this is an automation-oriented skill, so documenting secret-bearing network requests without safeguards can lead to credential exposure through logs, copied commands, or misuse in less trusted environments.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md

APP_SECRET=$(jq -r '.channels.feishu.appSecret' ~/.openclaw/openclaw-{agentId}.json)

# 获取 token
TOKEN=$(curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal/ \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This command sends message content and a bearer token to Feishu over the network, which is the core feature of the skill, but the documentation lacks any warning that outbound content may contain sensitive task results or personal data. In an agent-to-agent reporting context, automatic or scripted use increases the risk of unreviewed data exfiltration to external messaging channels.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md

-d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

# 发送私聊消息
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"ou_xxx\",\"msg_type\":\"text\",\"content\":\"{\\\"text\\\":\\\"消息内容\\\"}\"}"

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 451)May include surrounding context.

Q1: 发送失败，提示"配置文件不存在"

A: 检查 Agent 配置文件是否存在：

bash

ls -la ~/.openclaw/openclaw-{agentId}.json

Q2: 发送失败，提示"无法获取 token"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest content is presented entirely in Chinese, including operational instructions and warnings, and the tags include 'zh-CN' without any opt-in or stated region-specific justification. This can constitute a language/locale policy issue when users are not offered a language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest advertises automatic use of the current agent's Feishu credentials and outbound messaging, but does not prominently warn that messages and identifiers may be transmitted to an external service. This weakens informed consent and can lead users to enable a skill that exfiltrates operational content or contact targets without clearly understanding the privacy implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This example performs outbound message transmission to an external Feishu API, which is the core function of the skill; in context, the concern is not the API call alone but that the broader manifest encourages automatic sending without strong consent boundaries. Combined with auto-reply/auto-invocation language, this increases the risk of unreviewed disclosure of task content or identifiers to external recipients.

Content

Scanner excerpt · clawhub.yaml (reported line 88)May include surrounding context.

yaml

-d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')
  
  # 发送消息
  curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
    -H "Authorization: Bearer $TOKEN" \
    -H 'Content-Type: application/json' \
    -d "{\"receive_id\":\"oc_xxx\",\"msg_type\":\"text\",\"content\":\"{\\\"text\\\":\\\"消息\\\"}\"}"

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The notes instruct operators to extract user open_id values from service logs for later messaging. Service logs often contain sensitive identifiers and broader contextual data, so normalizing log scraping as a workflow increases the chance of unauthorized access, retention, and reuse of personal or account-linked identifiers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

No manifest is available, so the skill's purpose is unknown. The script reads a per-agent config file from the user's home directory and extracts Feishu app credentials, which is a sensitive capability not justified by any declared purpose or scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code accesses credentials from a local config file and then emits credential-related information to stdout. For code files, sensitive credential access should have safe user disclosure; printing identifier details can expose account metadata in terminals or logs instead of warning the user about credential handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code obtains an access token from Feishu and sends messages to Feishu recipients over the network. With no manifest available, this outbound network and messaging capability is unjustified by any stated skill purpose and therefore represents context-inappropriate capability.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawhub.yaml (reported line 83)May include surrounding context.

yaml

# 获取 token
echo "获取 token..."
TOKEN=$(curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal/ \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · send.sh (reported line 50)May include surrounding context.

sh

# 获取 token
echo "获取 token..."
TOKEN=$(curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal/ \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · send.sh (reported line 61)May include surrounding context.

sh

# 发送消息
echo "发送消息..."
RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=${MSG_TYPE}" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"$TARGET\",\"msg_type\":\"text\",\"content\":\"{\\\"text\\\":\\\"$MESSAGE\\\"}\"}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README content is written entirely in Chinese and does not indicate that other languages are supported or that the user can opt into a preferred language. Under the stated policy, natural-language content that effectively forces a specific language without user choice is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

All natural-language comments and runtime messages in the script are presented only in Chinese, which imposes a specific language without any user opt-in or alternative. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.