feishu-multi-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Feishu bot relay, but it gives broad group-chat users and configurable endpoints too much control over automated posting and sensitive conversation flow.

Review this before installing in any real Feishu group. Use only in a restricted test group, keep the OpenClaw endpoint on trusted loopback or HTTPS infrastructure, use narrowly scoped tokens, avoid committing the config file, and do not let untrusted group members send relay control phrases until the skill adds sender authorization, command namespacing, round limits, and safer log/state permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu_multi_agent.py:234

Finding

Arbitrary OpenClaw API Endpoint Can Exfiltrate API Credentials and Group Conversation Data

Content

View full analysis

str | None: api_url = cfg(config, "self_api_url", "http://127.0.0.1:18789") api_key = cfg(config, "self_token", "") model = cfg(config, "brain_model", "default") max_tok = cfg(config, "max_reply_tokens", 500) history_limit = cfg(config, "history_rounds", 5) sys_tmpl = cfg( config, prompt_template_key, "你是{self_name}，正在飞书群聊中与{peer_name}进行对话讨论。" "请根据当前消息给出自然、简短、有实质内容的回复（100字以内）。", ) if isinstance(sys_tmpl, list): sys_tmpl = "\n".join(sys_tmpl) system_prompt = sys_tmpl.format( self_name=cfg(config, "self_name", "机器人A"), peer_name=cfg(config, "peer_name", "机器人B"), topic=state.get("locked_topic") or "未锁定", ) if state.get("locked_topic"): system_prompt += ( f"\n\n【重要约束】当前讨论话题已锁定为：{state['locked_topic']}。" "请围绕该话题展开；如果对方跑题，请礼貌拉回主题。" ) messages = [{"role": "system", "content": system_prompt}] for msg in state.get("conversation_history", [])[-history_limit * 2 :]: messages.append({"role": msg["role"], "content": msg["content"]}) messages.append({"role": "user", "content": prompt_text}) payload = {"model": model, "max_tokens": max_tok, "messages": messages} ...[truncated 2581 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/feishu_multi_agent.py:474

Finding

Any Human Group Member Can Control the Relay and Trigger Unbounded Automated Activity

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu_multi_agent.py:415

Finding

Feishu Access Token Prefix Is Written to a Persistent Log

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu_multi_agent.py:92

Finding

Conversation History Is Persisted Without Explicit Owner-Only File Permissions

Content

View full analysis

max_history * 2: state["conversation_history"] = state["conversation_history"][-max_history * 2 :] ``` On common systems with umask `022`, a newly created regular file may be readable by other local users. Existing files with overly broad permissions are also not corrected. The retained data includes peer messages, generated replies, timestamps, and the locked topic. Local persistence supports context across daemon operations, but storing full message content without explicit access controls is not necessary. The script could retain minimal state or enforce owner-only permissions. ### Attack Path 1. The peer bot sends messages while a conversation is active. 2. `call_brain()` adds the peer content and generated response to `conversation_history`. 3. `save_state()` serializes the conversation history into the cache state file. 4. The file receives permissions bas ...[truncated 638 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using substring matching for "继续" creates ambiguous control boundaries: any message containing that text can resume the relay, even if the sender did not intend to control the bot. In this skill's context, that is more dangerous because the daemon continuously polls group history and can autonomously post messages, making accidental or adversarial triggering easy in a shared chat environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file explicitly tells users to prepare a Feishu App Secret and an OpenClaw API Token, but it does not include any warning about the sensitivity of these credentials or the need to store them securely. For a skill that requires secrets in a local config file, a user-facing warning about credential handling and exposure risk is expected.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises executable behavior involving shell, network, file read, and file write, but does not declare any explicit tool scope or permissions. This creates an authorization and review gap: operators cannot easily tell what capabilities the skill needs, and an agent runtime may grant broader access than users expect for a background daemon that polls chats and posts automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description explains that the skill relays messages between bots, but it does not prominently warn users that it performs autonomous background polling of group message history and automatic posting. This can mislead operators about privacy, consent, and operational risk, especially in group chats where unattended message generation may affect other participants.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "你们讨论一下" is broad natural language that can easily appear in ordinary conversation, especially in a group chat. Because this skill can start autonomous multi-agent relaying and background polling, accidental activation could cause unintended bot replies, noisy message loops, or unauthorized conversation automation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The control word "继续" is too generic to serve as a safe activation command in a live group chat. Normal users may say it in unrelated conversation, which could unintentionally resume autonomous bot-to-bot discussion and message posting without clear operator intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill uses natural-language triggers such as “讨论 XXX”, “只聊 XXX”, and especially substring matching for “继续”, which can cause the relay daemon to start or resume on ordinary group-chat messages that were not intended as control commands. In a multi-agent auto-reply setting, unintended activation is more dangerous because it can trigger autonomous cross-bot conversation, consume rounds/resources, and create noisy or hard-to-stop behavior in shared chats.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The configuration uses broad natural-language trigger keywords such as “继续”, “开始”, “解锁”, and multiple topic-lock phrases while require_mention is set to false, so ordinary group messages can unintentionally control the relay daemon. In a multi-bot group, this can cause unauthorized or accidental activation, continuation, topic changes, or prolonged bot-to-bot exchanges, consuming API quota and generating unintended messages without explicit operator intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

start-sync launches a long-running detached daemon and writes PID/log/state files under the user's home directory without any user-facing warning at launch time. This is dangerous in an agent setting because it creates persistent execution and data retention behavior that may continue polling messages and generating replies after the user no longer expects the skill to be active.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/feishu_multi_agent.py (reported line 585)May include surrounding context.

python

cleanup_pid_file()

    log_file = open(LOG_FILE, "a", buffering=1)
    proc = subprocess.Popen(
        [sys.executable, os.path.abspath(__file__), "daemon"],
        stdout=log_file,
        stderr=log_file,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill exposes a standalone manual send command that can post arbitrary text to the configured Feishu group, which exceeds the relay/listening behavior described in the manifest. In an agent-skill context, this broadens the capability surface and could be abused by a caller or chained workflow to send unintended messages, spam, or social-engineering content under the bot identity.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 24)May include surrounding context.

sh

echo "   配置文件已存在，跳过（如需重置：rm $TARGET && bash $0）"
else
    cp "$TEMPLATE" "$TARGET"
    chmod 600 "$TARGET"
    echo "   ✓ 配置文件已创建: $TARGET"
fi

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file's user-facing error/help text is written in Chinese, and the operational prompts and control strings throughout the script are also Chinese-centric. There is no indication that the skill offers a language or locale choice, which can violate a language/locale policy when users have not opted into Chinese-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config/relay-config.json:36