T08 · Insecure Dependencies
Warning
- Location
SKILL.md:197- Finding
Unpinned npm Package Execution Recommended with Automatic Confirmation and Elevated Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Official Plugin Switch
Security checks for vulnerabilities and agentic risk
Overview
The skill is a mostly disclosed Feishu plugin migration helper, but it asks users to run mutable npm installer commands, sometimes as root, while claiming success without actually verifying changes.
Review before installing. Treat the displayed install and diagnostic commands as manual, high-trust operations: pin the npm package to a specific reviewed version, avoid `sudo npx`, verify the package source and registry, back up OpenClaw configuration before switching plugins, and grant Feishu/Lark user permissions only if you accept broad read/write access to workspace content.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.ts:103- Finding
Operational Checks and Mutating Actions Return Fabricated Success Without Performing Any Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (31)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill promotes automatic plugin installation, plugin switching, service restart, and enabling new capabilities without clearly foregrounding the operational and data-access consequences before execution. In context, it also requests broad read/write user permissions later in the document, so the lack of up-front warning may lead users to authorize impactful system and privacy changes without informed consent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill instructs users to execute an unpinned package via npx, which fetches the latest published version at runtime. If the npm package is compromised, typo-squatted, or updated with malicious code, users could execute attacker-controlled code during installation or diagnostics.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
This command references the package without a pinned version, so execution depends on whatever version is current in the registry at the time the user runs it. That creates a supply-chain risk where a malicious or compromised release could run arbitrary code on the host.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Running unversioned tooling from npm through npx exposes users to remote code execution via the package registry supply chain. Because this skill is explicitly about installing and configuring a plugin, the package is likely to receive elevated trust and broad system access, increasing the blast radius of a bad release.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation recommends using sudo to install and run the package, which elevates execution to root. Because the command fetches code from npm at runtime, any compromise in the package or its dependencies would execute with full administrative privileges.
- Content
Q1: 插件安装失败？
bash # 使用 sudo sudo npx -y @larksuite/openclaw-lark-tools install # 使用国内镜像
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This line is the concrete privileged command: sudo npx -y @larksuite/openclaw-lark-tools install. It is dangerous because it combines root privileges, automatic package fetching, and non-interactive execution, maximizing the chance that users run unreviewed remote code with full system access.
- Content
Q1: 插件安装失败？
bash # 使用 sudo sudo npx -y @larksuite/openclaw-lark-tools install # 使用国内镜像 export NPM_CONFIG_REGISTRY=https://registry.npmmirror.com
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This example combines sudo with an unpinned npx package, meaning arbitrary code from the latest registry version may execute with root privileges. A compromised package or dependency would therefore gain full system control instead of only user-level access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill again instructs users to execute an unpinned package directly from npm, which can silently change over time. Even without sudo, that still enables arbitrary code execution in the user context and may expose local credentials, config files, or plugin state.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains extensive user-facing natural-language messages exclusively in Chinese, including setup instructions, warnings, and follow-up commands. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill instructs users to run an unpinned package via npx, which fetches and executes whatever version is current at execution time. If the package is compromised, typosquatted, or a malicious update is published, users could execute attacker-controlled code with their local privileges.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This command explicitly tells the user to install and execute a remote npm package with
npx -ywhile leaving the version unpinned. That increases risk because it suppresses prompts and makes execution of a future malicious or compromised release more likely and less noticeable.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The diagnostic command again references a mutable npm package without a fixed version, meaning later executions may run different code than what was reviewed. In an admin/operations workflow, such commands are especially risky because they are likely to be executed on production hosts with access to credentials and service configuration.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The
doctor --fixvariant is more dangerous because it both executes unpinned remote code and requests automatic remediation actions on the host. A compromised package could abuse the elevated trust of a 'fix' command to alter files, configs, or credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This informational command still executes code from an unpinned npm package and therefore carries remote code execution risk despite appearing harmless. Users may assume
infois read-only, making them less cautious about running a mutable package reference.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The diagnose section repeats the unsafe pattern of instructing users to execute an unpinned package from npm. Repetition across the skill increases exposure because users are likely to copy and run at least one of these commands during setup or troubleshooting.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The
doctor --fixcommand in troubleshooting is a true risk because it encourages running mutable remote code specifically in a context where users may also follow the nearby advice to use elevated privileges. That combination can turn a supply-chain compromise into full host compromise.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
Advising users to use
sudofor installation/troubleshooting materially increases blast radius if any referenced command or dependency is malicious or compromised. In this skill, that risk is amplified because the same workflow repeatedly recommends executing unpinned npm packages and config-changing commands, so running them as root could lead to full system compromise.- Content
js **常见问题：** 1. **需要 OAuth 授权吗？** → 可以跳过，基础功能不需要 2. **安装失败？** → 使用 sudo 或国内镜像 3. **流式没效果？** → 检查插件状态和配置 4. **Coze 上失败？** → 设置 npm 镜像地址
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is entirely in Chinese and presents the skill in a fixed locale without indicating that users can choose another language or that the skill is intentionally region-specific. The policy specifically calls for flagging language or locale constraints when they are imposed without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file contains extensive user-facing natural-language prompts and instructions entirely in Chinese, including activation and operational guidance. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation unless the locale constraint is explicitly documented and justified.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill instructs users to run an unpinned NPX package, which fetches the latest published code at execution time. If the package is compromised, typosquatted, or updated with breaking or malicious behavior, users may execute unreviewed code with local access.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
This installation step uses
npx -ywith an unpinned package, combining automatic consent with execution of whatever version is current in the registry. That increases supply-chain risk and reduces the chance a user notices unexpected package changes before code runs.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs disabling one plugin, enabling another, and restarting the service, but does not provide an explicit warning that local configuration will be modified or offer backup/rollback guidance. In a setup assistant context, users may treat these steps as safe routine actions and unintentionally disrupt service or lose a known-good configuration.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The diagnostic command references an unpinned NPX package, so the code executed during troubleshooting may differ from the reviewed version described elsewhere in the skill. Even diagnostic tools can access local files, network, and credentials when run on a user machine.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
This auto-fix command runs an unpinned remote package and explicitly enables mutation of local configuration. That creates a supply-chain path to arbitrary configuration changes or code execution under the user's account.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The
infocommand still executes an unpinned NPX package, exposing users to the same registry and publisher compromise risks. Context makes this risk real because the skill repeatedly nudges users to trust and run these commands as part of setup and validation.- Content
Static analysis
No suspicious patterns detected.