飞书文档权限自动添加

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:33 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for Feishu document permission automation, but it handles app secrets and full document-control grants in ways users should review carefully before installing.

Review before installing. Do not paste a real Feishu App Secret into chat; prefer preconfiguring it through a secure secret mechanism and restrict local config file permissions if file storage is unavoidable. Before any permission change, confirm the exact document, recipient open_id, and permission level, and use view or edit unless full_access is truly needed. Rotate the App Secret if it has already been exposed in chat or logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:196

Finding

Shell Command Injection Through Unvalidated User-Controlled Values

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:489

Finding

Application Secret Is Collected Through the Conversation and Stored in Plaintext Configuration

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:244

Finding

Automatic Grant of Full Document-Control Privileges Violates Least Privilege

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells users to send the App Secret directly in conversation without a strong warning that it is a sensitive credential. Chat channels are commonly logged, retained, and visible to operators or other systems, so requesting secrets there materially increases the chance of credential compromise.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section combines two risky behaviors: requesting sensitive application credentials in chat and writing them to local configuration. That broadens exposure from transient chat leakage to durable local compromise, enabling unauthorized use of the Feishu app if the endpoint, logs, or config file are accessed.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 572)May include surrounding context.

md

|--------|---------|------|----------|----------|
| `10003` | app id or app secret is invalid | App ID 或 App Secret 错误 | 检查配置，确保复制正确 | 重新配置后重试 |
| `99991661` | 成员已存在 | 用户已有权限 | 视为成功，无需处理 | 直接返回成功 |
| `99991663` | Invalid access token | token 过期或无效 | 重新获取 tenant_access_token | 重新执行 2.2 |
| `99991664` | Permission denied | 应用没有权限 | 引导配置应用权限 | 跳转配置引导 C |
| `99991600` | token not found | 文档 token 不存在 | 检查 file_token 是否正确 | 确认后重试 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes automatically granting Feishu document permissions, including edit or full_access, but does not warn about the security implications of broadening access to newly created documents. In this skill context, the behavior directly changes access control on enterprise documents, so missing warnings and guardrails can lead to unintended privilege grants or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The configuration section instructs users to store Feishu app credentials in a local JSON config without any warning that appSecret is sensitive or guidance on secure storage. If that file is exposed through backups, logs, screenshots, or weak filesystem permissions, an attacker could reuse the credentials to obtain Feishu access tokens and operate on documents via the app.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 138)May include surrounding context.

md

## ⭐ Star History

[![Star History Chart](https://api.star-history.com/image?repos=sadjjk/openclaw-feishu-docs-perm-auto&type=date&legend=top-left)](https://www.star-history.com/?repos=sadjjk%2Fopenclaw-feishu-docs-perm-auto&type=date&legend=top-left)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

feishu_app_scopes()

# 获取 tenant_access_token
exec('curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" ...')

# 添加权限
exec('curl -s -X POST "https://open.feishu.cn/open-apis/drive/v1/permissions/..." ...')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

请求：

bash

curl -s -X POST "https://open.feishu.cn/open-apis/drive/v1/permissions/{FILE_TOKEN}/members/batch_create?type={DOC_TYPE}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {tenant_access_token}" \
  -d "{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill recommends asking whether to write ownerOpenId into configuration, which persists an identifier tied to a user account. While less sensitive than an app secret, storing personal identifiers without clear notice, purpose limitation, or retention guidance creates privacy and unnecessary data persistence risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to ask the user to paste Feishu App ID and App Secret into chat, then validate and persist them in a local config file. Collecting and storing long-lived application credentials is more sensitive than the stated task of adding document permissions, and creates unnecessary secret exposure through chat transcripts and filesystem persistence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.