ClawHub
Back to skill

Security audit

feishu-chatfile-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform its stated Feishu image-delivery workflow, but it handles Feishu credentials and outbound sending with too little scoping and user warning.

Review before installing. Use this only in an environment where sending generated images to Feishu is expected, and prefer a dedicated low-privilege Feishu app credential. Avoid confidential images unless you are comfortable with them being transmitted to Feishu, and do not expose app secrets in shell history, process listings, logs, or shared transcripts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly directs use of shell commands and outbound network access, yet it declares no permissions or equivalent user-visible capability boundary. This weakens oversight and informed consent, especially because the skill can read local configuration secrets and transmit files externally to Feishu.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The instruction to automatically send generated images to the current Feishu conversation without waiting for confirmation creates a data-exfiltration and privacy risk. Generated images may contain sensitive user data, internal analysis, or unintended content, and the skill normalizes transmission without an explicit warning or approval step.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs operators to retrieve app_id and app_secret from a local config file and pass them on the command line, without any warning about secret exposure. This increases the chance of credential leakage via shell history, process listings, logs, or accidental echoing, and those credentials authorize external messaging actions.

Static analysis

No suspicious patterns detected.