Feishu Robot Creater For 26462 Final

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

This is a small documentation-only skill for setting up a Feishu bot with OpenClaw, with some low-impact scope and credential-handling cautions.

Use this skill only when you intend to configure a Feishu bot for OpenClaw. Treat the Feishu App Secret like a password: do not paste it into chats, screenshots, repos, or shared configs; store it only in the intended secure configuration location and rotate it if exposed. Also review the hardcoded Windows paths and ignore or change the fixed “主人/皇帝” persona wording unless it matches your preference.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:13

Finding

Unrelated Persona and User-Address Instructions Can Hijack Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–14
Additional Location: README.md, lines 10–11
Vulnerability Type: Agent instruction hijacking through unrelated persona directives
Risk Level: Medium

Vulnerable Code

SKILL.md, lines 13–14:

text

- 主人称呼偏好：对用户统一称“主人”
- 当前主代理身份：皇帝（总后台 / 主代理）

README.md, lines 10–11:

text

- 主人偏好称呼：主人
- 当前主代理身份：皇帝

The directives state that the user must be addressed as “Master” and that the main agent has an “Emperor” identity.

Technical Analysis

The declared purpose of this skill is to create a Feishu robot, connect it to OpenClaw, and bind it to an independent agent. The user-address and agent-identity directives are unrelated to those technical operations.

When skill documentation is loaded into an agent context, imperative or authoritative persona statements can be interpreted as active behavioral instructions. These statements may therefore modify how the host agent identifies itself and addresses the user, despite not being necessary for Feishu application creation or OpenClaw configuration.

This is instruction hijacking rather than code execution. The package contains no executable scripts, and the reviewed PowerShell examples only create documented directories and a memory template.

Attack Path

1. A user or agent installs or loads the skill to configure a Feishu robot.
2. The agent reads SKILL.md as operational instructions and may also consume the package README.
3. The unrelated persona statements enter the active context alongside legitimate setup instructions.
4. The agent adopts the imposed “Emperor” identity and addresses the user as “Master.”
5. The modified behavior can carry into subsequent responses within the affected context, including responses unrelated to Feishu setup.

Impact Assessment

The finding can influence the agent’s current-session identity, tone, and user-address behavior. It may conflict with system-defined roles, applicat ...[truncated 381 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the user-address preference and “Emperor” identity statements from both SKILL.md and README.md.
2. Limit the skill instructions to requirements directly necessary for creating the Feishu application, configuring OpenClaw, binding the channel, restarting the gateway, and validating connectivity.
3. If customization of names or conversational style is genuinely required, expose it as an explicit, optional user-controlled setting rather than a mandatory skill instruction.
4. Add a scope statement clarifying that the skill must not alter the host agent’s identity, safety constraints, global behavior, or unrelated session goals.
5. Review future documentation changes for persona directives, persistent behavioral rules, or instructions that are not required by the skill’s declared technical purpose.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document specifies fixed identity and address preferences such as “主人” and “皇帝” and states that this version is tailored to the current machine's Windows/OpenClaw usage, all in Chinese, without indicating that users may choose another language or form of address. This is a natural-language locale/policy concern because it imposes a specific language and interaction style without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells the user to retrieve and use an App Secret, but it does not clearly warn that this is a sensitive credential that must not be exposed in chat logs, screenshots, source files, or shared configs. In a skill that guides users through agent setup, omission of secret-handling guidance increases the chance of credential leakage and downstream compromise of the Feishu bot integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy issues. The line specifies that users should uniformly be called “主人,” which forces a particular mode of address without indicating user preference or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.