ClawHub
Back to skill

Security audit

Feishu Send Message

Security checks across malware telemetry and agentic risk

Overview

This is a real Feishu messaging helper, but it can send external messages with local agent credentials and documents automatic replies without enough scoping controls.

Install only in workspaces where agents are allowed to send Feishu messages. Restrict access to ~/.openclaw/openclaw-*.json, verify the agentId and recipient before sending, avoid sending secrets or sensitive task outputs, and do not enable the message.received hook unless you add trusted-sender allowlists, rate limits, and loop prevention.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly documents automatic replies on message reception and repeated use of a send script, but it does not include clear safeguards about unsolicited outbound messaging, spam risk, privacy implications, or accidental disclosure to the wrong recipient or group. In this context, the feature is intended, but the missing warnings and guardrails make misuse and unintended external communication more likely.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation shows how to read Feishu App ID/App Secret from local configuration and immediately use them in external API calls, but it does not warn about secret exposure, shell history/logging, or the sensitivity of transmitting credentials and message content to a third-party service. Even though this is standard API usage, omitting credential-handling guidance creates a real operational security weakness.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest advertises that the skill is usable immediately and that an agent will 'automatically scan and invoke' it, but it does not define concrete trigger conditions, authorization boundaries, or consent requirements. For a messaging skill that can send outbound Feishu messages using agent credentials, ambiguous auto-invocation language can cause unintended message transmission or abuse by prompt/content injection through normal agent workflows.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The 'automatic call' section says the skill supports automatic sessions_send invocation and that the agent will auto-reply after receiving a message, but it does not explain what messages qualify, how loops are prevented, or what safety checks are applied. In a communication tool, this ambiguity can enable spam, message storms, or unauthorized forwarding triggered by untrusted incoming content.

Ssd 3

Medium
Confidence
94% confidence
Finding
The notes instruct operators to extract user open_id values from service logs using journalctl and grep, then use those identifiers for later messaging. Harvesting identifiers from logs increases exposure of user metadata, encourages secondary use of logged data without clear consent, and can enable targeted unsolicited messaging if logs are broadly accessible.

External Transmission

Medium
Category
Data Exfiltration
Content
APP_SECRET=$(jq -r '.channels.feishu.appSecret' ~/.openclaw/openclaw-{agentId}.json)

# 获取 token
TOKEN=$(curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal/ \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')
Confidence
95% confidence
Finding
curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal/ \ -H 'Content-Type: application/json' \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
-d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | jq -r '.tenant_access_token')

# 发送私聊消息
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"ou_xxx\",\"msg_type\":\"text\",\"content\":\"{\\\"text\\\":\\\"消息内容\\\"}\"}"
Confidence
91% confidence
Finding
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"receive_id\":\"ou_xxx

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.