Feishu Ai Coding Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 1.0.0

Overview

The skill appears to be an AI coding helper, but it requests broad agent, command, file, and session powers while also shipping exposed publishing tokens and risky install guidance.

Install only after the publisher removes and rotates the exposed tokens, narrows the manifest permissions to implemented features, and adds explicit confirmation for global package installation, command execution, file modification, session-history access, and persistent thread binding. Use a sandboxed workspace if evaluating it before those changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: publish.sh:10

Finding

Hardcoded ClawHub and GitHub Access Tokens

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: src/index.ts:25

Finding

Unsafe Global Installation of External npm Packages

Content

View full analysis

= { 'opencode': { name: 'OpenCode', version: '1.2.24', installCommand: 'npm install -g opencode@1.2.24', checkCommand: 'opencode --version', description: '开源免费，SST 出品，适合基础代码生成', runtime: 'acp' }, 'claude-code': { name: 'Claude Code', version: '2.1.72', installCommand: 'npm install -g @anthropic-ai/claude-code@2.1.72', checkCommand: 'claude-code --version', description: 'Anthropic 官方，强大推理，适合复杂逻辑', runtime: 'acp' }, 'codex': { name: 'Codex', version: '3.5.0', installCommand: 'npm install -g openai-codex@3.5.0', checkCommand: 'codex --version', description: '多语言支持，适合全栈开发', runtime: 'acp' }, 'cursor': { name: 'Cursor', version: '0.40.0', installCommand: 'npm install -g cursor-cli@0.40.0', checkCommand: 'cursor --version', description: '编辑器集成，适合日常开发', runtime: 'acp' }, 'continue': { name: 'Continue', version: '0.8.0', installCommand: 'npm install -g continue-dev@0.8.0', checkCommand: 'continue --version', description: 'VS Code 插件，轻量级选择', runtime: 'acp' } }; ``` ### Technical Analysis The Skill instructs users to globally install several external npm packages. npm packages can execute lifecycle scripts during installation, including `preinstall`, `install`, and `postinstall`. Such scripts execute with the privileges of the user running npm and are not confined to the Skill workspace. Version pinning reduces unintended version drift but does not establish package authenticity or integrity. The project does not provide: - Registry integrity hashes - A lockfile for these global tools - Publishe ...[truncated 2323 chars]

Remediation

View remediation

@ ``` 6. If lifecycle scripts are required, inspect them and all transitive dependencies before approval. 7. Require explicit user confirmation before any installation and clearly explain that external code may execute. 8. Never recommend running the installation as root or with `sudo`. 9. Standardize versions across `src/index.ts`, `skill.json`, `SKILL.md`, `README.md`, and `INSTALL.md`. 10. Add automated dependency provenance, malware, vulnerability, and typosquatting checks to the release process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill.json:115

Finding

Manifest Requests Broad Unused Execution, Filesystem, and Session Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (31)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 163)May include surrounding context.

claw skill uninstall feishu-ai-coding-assistant

或手动删除

rm -rf ~/.openclaw/skills/feishu-ai-coding-assistant

text

## 获取帮助

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 163)May include surrounding context.

claw skill uninstall feishu-ai-coding-assistant

或手动删除

rm -rf ~/.openclaw/skills/feishu-ai-coding-assistant

text

## 获取帮助

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script contains hardcoded ClawHub and GitHub access tokens directly in source code, which is a clear credential exposure vulnerability. Anyone with access to the file can reuse these secrets to authenticate to external services, publish content, push code, or take other actions permitted by the tokens, and the publication context makes the exposure especially dangerous because the script is intended to be shared and executed.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script not only embeds authentication tokens but also uses them directly in commands without any safe handling, masking, or user protection. This can expose secrets through source control, terminal history, process inspection, logs, or accidental redistribution, enabling unauthorized access to GitHub and ClawHub.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 127)May include surrounding context.

md

### 问题 3: 子 Agent 创建失败

**错误:** `Failed to create subagent`

**解决:**
1. 检查 OpenClaw 权限配置

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The uninstall section instructs users to run a recursive force-delete command against a path under their home directory without any warning, confirmation guidance, or backup caution. While the specific path is narrower than a full home-directory wipe, destructive shell commands in installation docs can cause irreversible data loss if copied incorrectly, expanded unexpectedly, or adapted by users without understanding the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README explicitly advertises automatic tool installation and background sub-agent execution, but does not clearly warn users that invoking the skill may install global packages, launch autonomous processes, and modify files in the workspace. In an agent skill context, lack of disclosure materially increases the risk of unexpected system changes and unsafe delegation to sub-agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Documenting autoInstall: true without a warning normalizes unattended package installation and hides the trust boundary around external dependencies and global system changes. If users enable this blindly, the skill could fetch and install tooling from package registries with elevated trust and little operator awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly enables automatic installation of developer tools and promotes ACP/file-command capable runtimes, but it does not clearly warn that using the skill may modify the host system, install global packages, create files, or execute commands. In an agent setting, this can lead users to authorize actions with system-wide impact without informed consent, increasing the risk of unwanted package installation, workspace modification, or execution of unsafe generated commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script logs into ClawHub, pushes to GitHub, and publishes the skill remotely, all of which are network operations that transmit repository and skill data. While the script prints step names, it does not clearly warn the user that running it will send data to third-party services using provided credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest enables automatic installation of external tooling and grants powerful permissions including exec, process control, session spawning, and filesystem write/edit access, but the description does not clearly warn users that installing the skill may execute package-manager commands and create code-executing subagents. In a coding-assistant context these capabilities may be functionally expected, but combining autoInstall=true with broad permissions materially increases the risk of unintended command execution, supply-chain exposure, and abuse if the skill or its downstream tools are compromised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level documentation explicitly claims automatic tool detection/installation, child-agent session creation, persistence support, and execution monitoring. In the code, tool checks are stubbed to always report not installed, install only prints shell commands, and agent management paths return placeholder text rather than invoking real operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s user-facing descriptions, menus, help text, and prompts are consistently presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The help documentation describes operational commands such as creating sub-agents, checking installation status, killing agents, and steering running sessions. However, the corresponding handlers only return explanatory strings saying the real action would need to be executed in a real environment, so the documented behavior materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This TypeScript test file contains natural-language expectations exclusively in Chinese, including user-facing command descriptions and prompts. Under the policy rule for language/locale, this indicates the skill is designed to respond in a fixed language without evidence of user choice or documented locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document forces a specific language/locale for all user-facing instructions, and there is no indication that the skill is region-specific or that alternative language documentation is available. Under the stated policy, a fixed language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

All user-facing instructions and examples in the README are presented in Chinese, and the document does not indicate that another language option is available. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The skill's natural-language interface and examples are entirely presented in Chinese, and no opt-in or language-selection guidance is provided. Under the policy, forcing a specific language without user choice can be a locale-policy issue unless the skill is clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill advertises persistent session history and thread-bound channel routing without clearly disclosing retention, visibility, or privacy implications. Persistent bindings can cause prior context, project data, or sensitive prompts to be retained and automatically routed across interactions in ways users may not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill as a Chinese-language assistant, but this file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"author": "OpenClaw Skill Master",
  "license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@types/jest": "^29.5.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@types/jest": "^29.5.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",
    "eslint": "^8.50.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^20.10.0",
    "@types/jest": "^29.5.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",
    "eslint": "^8.50.0",
    "jest": "^29.7.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

"@types/node": "^20.10.0",
    "@types/jest": "^29.5.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",
    "eslint": "^8.50.0",
    "jest": "^29.7.0",
    "ts-jest": "^29.1.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json

"@types/jest": "^29.5.0",
    "@typescript-eslint/eslint-plugin": "^6.0.0",
    "@typescript-eslint/parser": "^6.0.0",
    "eslint": "^8.50.0",
    "jest": "^29.7.0",
    "ts-jest": "^29.1.0",
    "ts-node": "^10.9.2",

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: INSTALL.md:163

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: publish.sh:11