ClawHub
Back to skill

Security audit

飞书多机器人多Agent配置

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent setup guide, but it recommends open Feishu access settings that could let unintended users reach configured agents.

Review the access policy examples before installing or following this guide. Keep pairing or explicit allowlists enabled for direct messages and groups unless you intentionally need public access, and restrict any public-facing agent's tools, files, credentials, logging, and rate limits. Protect the OpenClaw config containing Feishu secrets and do not commit it to source control.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:64
Finding

Unrestricted Feishu Group Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 64
Vulnerability Type: Unrestricted group access policy
Risk Level: Medium

Vulnerable Configuration

json5
groupPolicy: "open",

Technical Analysis

The example configuration sets the Feishu group access policy to open. This weakens access control by allowing messages from groups without requiring an explicit group allowlist or equivalent authorization boundary.

Because incoming messages are routed to an Agent, users in any group where the bot is reachable may submit attacker-controlled instructions. The effective severity depends on the tools, credentials, files, and external services available to the routed Agent.

Attack Path

  1. An attacker gains access to, or invites the bot into, a Feishu group accepted by the open policy.
  2. The attacker sends a message or mention containing instructions for the bot.
  3. The Gateway accepts the message because no restrictive group allowlist is configured.
  4. The message is routed through the configured binding to an Agent.
  5. The Agent processes the attacker's instructions and may invoke any capabilities available in its execution context.

Impact Assessment

An unauthorized group participant may consume Agent and model resources, submit prompt-injection content, elicit workspace-derived information, or invoke tools exposed to the Agent. The maximum scope is limited to the permissions and resources assigned to the affected Agent, Feishu bot, and Gateway environment.

Remediation
View remediation

Remediation Suggestions

  • Replace the open group policy with a restrictive policy supported by OpenClaw.
  • Maintain an explicit allowlist of approved Feishu group identifiers.
  • Deny access by default and require administrative approval before enabling the bot in a new group.
  • Assign each Agent only the minimum tools, credentials, files, and external-service permissions required for its role.
  • Separate public-facing Agents from Agents that can execute commands or access sensitive workspaces.
  • Log rejected and accepted group requests, and alert on access attempts from unknown groups.
  • Document the open policy only as a risk-accepted exception rather than using it in the default example.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:187
Finding

Direct-Message Pairing Bypass Through Wildcard Authorization

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 187
Vulnerability Type: Authentication and pairing bypass
Risk Level: High

Vulnerable Configuration

json5
dmPolicy: "open" + allowFrom: ["*"]

Technical Analysis

The guide recommends combining an open direct-message policy with a wildcard sender rule as an alternative to approving the initial pairing request. This explicitly bypasses the identity-approval control described immediately beforehand.

The wildcard authorizes every sender rather than a defined set of trusted Feishu identities. Consequently, possession of a valid pairing approval is no longer required, and any user who can reach the bot may provide input to the routed Agent.

This is an access-control failure rather than evidence of malicious implementation. Nevertheless, using the documented configuration creates a direct unauthorized-access path, especially when the Agent has file, command-execution, credential, memory, or external-service capabilities.

Attack Path

  1. An administrator applies dmPolicy: "open" and allowFrom: ["*"].
  2. An attacker discovers or otherwise reaches the Feishu bot.
  3. The attacker starts a direct-message conversation without obtaining pairing approval.
  4. The wildcard rule accepts the attacker's identity.
  5. The Gateway routes the direct message to the Agent associated with that Feishu account or matching binding.
  6. The attacker submits instructions, including possible prompt-injection payloads or requests to invoke exposed tools.
  7. The Agent processes those requests within the permissions of its workspace, configured tools, credentials, and service accounts.

Impact Assessment

The configuration permits unauthorized invocation of the affected Agent by any reachable Feishu identity. Potential consequences include resource consumption, exposure of information available through the Agent's context, abuse of external integrations, an ...[truncated 340 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove allowFrom: ["*"] and do not present wildcard authorization as a routine alternative to pairing.
  • Retain the documented pairing workflow and require an administrator to approve each trusted sender.
  • If pairing cannot be used, configure an explicit allowlist containing only approved Feishu user identifiers.
  • Use a deny-by-default direct-message policy.
  • Periodically review and revoke stale pairing approvals and allowlist entries.
  • Apply least privilege to every routed Agent, particularly for command execution, filesystem access, secrets, and external integrations.
  • Use a dedicated, capability-restricted Agent if public interaction is a business requirement.
  • Add audit logging and rate limits for direct-message requests, with alerts for repeated unapproved access attempts.
  • Clearly warn that disabling pairing exposes the Agent to all reachable users and should require documented risk acceptance.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide suggests dmPolicy: "open" with allowFrom: ["*"] to bypass pairing, which effectively removes access control for direct messages. In a bot exposed to organizational or public messaging contexts, this can allow any sender to interact with the agent, increasing the risk of unauthorized use, prompt abuse, data disclosure, spam, or unintended tool execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

为每个新 Agent 创建独立工作空间目录：

bash
mkdir -p ~/.openclaw/workspace-<agentId>/memory ~/.openclaw/workspace-<agentId>/avatars

创建必要的文件：

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

为每个新 Agent 创建独立工作空间目录:

bash
mkdir -p ~/.openclaw/workspace-<agentId>/memory ~/.openclaw/workspace-<agentId>/avatars

创建必要的文件:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide instructs users to place Feishu app credentials directly in a local configuration file, which creates a real secret-handling risk if that file is readable by other local users, accidentally committed to source control, included in backups, or exposed in logs. Although this is common in setup documentation, the absence of stronger guidance on secret storage, access control, rotation, and avoiding plaintext distribution makes credential exposure more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

md
- 每个 Agent 的 `agentDir` 必须唯一，不能共享，否则会 auth/会话冲突
- 飞书应用需要在开放平台完成：机器人能力、权限、事件订阅（长连接）、发布审批
- `appId` 和 `appSecret` 放在配置文件中，确保文件权限安全（`chmod 600`）
- 删除 Agent 时用 `openclaw agents delete <agentId>`，会清理对应的工作空间和会话