T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:74
- Finding
- Unsafe Extraction and Handling of Feishu Application Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 74–76 **Vulnerability Type**: Plaintext credential exposure and excessive secret access **Risk Level**: High **Vulnerable Code**: ```markdown **Feishu/Lark** (message tool corrupts non-ASCII filenames, use curl instead): 1. Get credentials: read `app_id` and `app_secret` from the config file (e.g. `cat ~/.openclaw/openclaw.json | jq '.channels.feishu'` instead of `openclaw config get`). Make sure to use the credentials matching the current account. 2. Get token: `curl -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' -H 'Content-Type: application/json' -d '{"app_id":"<app_id>","app_secret":"<app_secret>"}'` ``` ### Technical Analysis The workflow directs the agent to read the entire `.channels.feishu` configuration object from `~/.openclaw/openclaw.json`, including the plaintext `app_secret`, and then interpolate that secret into a command-line request. This handling pattern violates least-exposure principles. Sensitive values may enter the agent context, tool-call records, shell history, process-monitoring output, debugging logs, or audit transcripts. Reading the complete Feishu channel configuration also accesses more data than is strictly necessary to obtain the two required fields. Although the request is sent to the official `open.feishu.cn` endpoint, the local secret-handling method creates a credential-disclosure risk independent of transport security. ### Attack Path 1. A user invokes the Skill and requests delivery through Feishu/Lark. 2. The agent executes the prescribed command to read `.channels.feishu` from `~/.openclaw/openclaw.json`. 3. The Feishu application ID and secret are returned through the command or tool context. 4. The agent embeds the secret in the `curl` command body. 5. A party with access to agent transcripts, tool logs, shell history, process arguments, or debugging output obtains the ...[truncated 820 chars]
- Remediation
- ## Remediation Suggestions 1. Use the platform-native authenticated messaging interface instead of manually retrieving and transmitting application credentials. 2. Store credentials in a dedicated secret manager or protected credential provider rather than a general configuration file. 3. Retrieve only the exact required values; do not print or return the complete Feishu channel configuration. 4. Pass secrets through protected environment variables, standard input, or an API client that prevents their appearance in process arguments. 5. Disable shell tracing and command echoing for credential-bearing operations, and prevent sensitive commands from being written to shell history. 6. Redact `app_secret`, access tokens, and related authorization values from tool output, logs, exceptions, and agent transcripts. 7. Apply restrictive filesystem permissions to credential storage and restrict access to the account executing the Skill. 8. Grant the Feishu application only the minimum API scopes required for file delivery. 9. Rotate the application secret if the existing workflow has already exposed it through logs or transcripts.