📄 Feishu Doc Manager | 飞书文档管理器

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:31 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Feishu document-management helper, but users should be careful with document edits, collaborator permissions, and the unpinned GitHub install instructions.

Install from a reviewed version when possible, or pin and inspect the GitHub repository before placing it in the active skills directory. Use least-privilege Feishu credentials and confirm any document deletion, overwrite, or collaborator permission change before allowing the agent to act.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51
• Finding: Unpinned Third-Party Skill Installation from a Mutable Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51-54 **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash cd ~/.openclaw/workspace/skills git clone https://github.com/Shuai-DaiDai/feishu-doc-manager.git ``` ### Technical Analysis The installation instructions clone the default branch of an external, personally managed GitHub repository directly into the OpenClaw skills directory. The repository is not pinned to an audited commit or immutable release, and the instructions do not require signature or checksum verification. Because the default branch is mutable, the content installed by users can differ from the content that was previously reviewed. An upstream maintainer, a compromised maintainer account, or an attacker who gains control of the repository could add malicious skill instructions, scripts, or dependencies after publication. The `git clone` command does not itself execute the downloaded content. Exploitation requires the cloned skill to be subsequently loaded, interpreted, or invoked by OpenClaw or the user. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or another mechanism capable of changing its default branch. 2. The attacker adds malicious instructions, executable scripts, or unsafe dependencies to the repository. 3. A user follows the documented Quick Start instructions. 4. Git retrieves the current attacker-controlled default branch directly into `~/.openclaw/workspace/skills`. 5. OpenClaw or the user subsequently loads or invokes the downloaded skill. 6. The malicious content operates with the permissions available to the relevant OpenClaw or user process. ### Impact Assessment Successful exploitation could allow attacker-controlled content to influence the agent or execute under the privileges of the process that loads or invokes the cloned skill. Depending on the subsequently down ...[truncated 707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation to a specific, reviewed commit hash instead of relying on the mutable default branch: ```bash git clone https://github.com/Shuai-DaiDai/feishu-doc-manager.git cd feishu-doc-manager git checkout --detach <audited-commit-hash> ``` 2. Publish signed, versioned releases and instruct users to verify the release signature before installation. 3. Provide a cryptographic checksum for each reviewed release archive and require checksum validation. 4. Review all skill instructions, scripts, manifests, and dependencies before placing the repository in an active skills directory. 5. Download and inspect the repository in a staging location first, then copy only reviewed files into the skills directory. 6. Apply least-privilege controls to the OpenClaw process and Feishu credentials so a compromised skill cannot access unrelated local resources or documents. 7. Document the exact audited version and establish a controlled update process that requires security review before changing the pinned revision. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises document creation, writing, deletion, and collaborator/permission management but does not clearly warn users that these actions can modify or expose documents. In an agent setting, missing safety guidance increases the chance of accidental destructive edits or unintended permission grants, especially when the model acts on ambiguous user requests.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file consistently presents the skill in bilingual English/Chinese form and brands it as a Chinese-language Feishu tool, but it does not state whether language output is optional or user-selectable. Under SQP-3, forced language or locale behavior without opt-in can be a policy concern when no choice is offered.

Static analysis

No suspicious patterns detected.