Feishu Public Table Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.0.4

Overview

The skill does what it claims, but its script can fetch arbitrary URLs instead of only public Feishu/Lark pages, which creates a review-worthy network access risk.

Install only if you trust the users or automations that will supply the monitored URL. Prefer running it with an explicit Feishu/Lark HTTPS allowlist and network egress controls, and keep the state directory limited to a dedicated monitor data folder.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor_feishu_price_table.py:31

Finding

Unrestricted User-Supplied URL Fetching Enables SSRF

Content

View full analysis

Vulnerability Details

File Location: scripts/monitor_feishu_price_table.py, lines 31–36, 184–187, 192–201, and 497–508
Vulnerability Type: Server-Side Request Forgery through insufficient URL and redirect validation
Risk Level: Medium

Vulnerable Code

python

resp = http.get(
    url,
    timeout=30,
    headers={"User-Agent": USER_AGENT},
    allow_redirects=True,
)

python

def client_vars_api_url(page_url: str) -> str:
    parsed = urlparse(page_url)
    if not parsed.scheme or not parsed.netloc:
        raise RuntimeError("飞书链接格式不正确，无法构造分页接口")
    return f"{parsed.scheme}://{parsed.netloc}/space/api/docx/pages/client_vars"

python

resp = session.get(
    client_vars_api_url(page_url),
    params=query,
    timeout=30,
    headers={
        "User-Agent": USER_AGENT,
        "Accept": "application/json, text/plain, */*",
        "Referer": page_url,
    },
)

python

parser.add_argument("url")
parser.add_argument("--section-title", default=DEFAULT_SECTION_TITLE)
parser.add_argument(
    "--state-dir",
    default=str(
        Path.home()
        / ".openclaw"
        / "workspace"
        / "data"
        / "feishu-monitors"
    ),
)
parser.add_argument("--print-snapshot", action="store_true")
args = parser.parse_args()

state_dir = Path(args.state_dir)
state_dir.mkdir(parents=True, exist_ok=True)
key = hashlib.sha256(
    (args.url + "\0" + args.section_title).encode("utf-8")
).hexdigest()[:16]
state_path = state_dir / f"{key}.json"

snapshot = snapshot_from_url(args.url, args.section_title)

Technical Analysis

The positional url argument is passed directly into the HTTP request. Validation only checks that the parsed URL contains a scheme and network location. It does not:

• Require HTTPS.
• Restrict destinations to legitimate Feishu or Lark domains.
• Reject loopback, private, link-local, reserved, or cloud metadata IP addresses.
• Reject embedded credentials or unexpected ports.
• Validate the IP addr ...[truncated 2546 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce an HTTPS-only policy

   • Reject every URL whose normalized scheme is not exactly https.

2. Allowlist supported domains

   • Permit only explicitly supported Feishu and Lark hostnames or carefully validated domain suffixes.
   • Compare normalized hostnames, not raw URL strings.
   • Ensure suffix checks require a label boundary so domains such as feishu.cn.attacker.example cannot pass.

3. Block internal and special-purpose addresses

   • Resolve all destination hostnames before connecting.
   • Reject every resolved address that is loopback, private, link-local, multicast, unspecified, reserved, or otherwise non-global.
   • Apply the check to both IPv4 and IPv6 addresses.

4. Harden redirect handling

   • Disable automatic redirects and process redirects manually.
   • Reapply scheme, hostname, port, and resolved-IP validation to every redirect destination before following it.
   • Set a small redirect limit.

5. Reduce DNS-rebinding exposure

   • Ensure the address validated is the address used for the connection where practical.
   • Revalidate DNS results immediately before every network request.

6. Restrict URL authority components

   • Reject embedded usernames and passwords.
   • Permit only expected ports, normally TCP 443.
   • Reject malformed or ambiguous host encodings.

7. Minimize Referer disclosure

   • Do not send the complete input URL as the Referer if it may contain query parameters or fragments.
   • Construct a sanitized Referer containing only the validated scheme, host, and safe path when the endpoint requires it.

8. Apply the same policy consistently

   • Use one centralized URL validation routine for the initial document request, redirects, and pagination requests.
   • Verify that the derived pagination endpoint remains on the validated Feishu/Lark origin.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes behavior that requires network access and local state reads/writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: a runner may grant broader-than-expected capabilities, and reviewers or policy engines cannot reliably constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.