ClawHub
Back to skill

Security audit

Multilingual KB Update

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated KB-update purpose, but it can edit local files, update Feishu, create GitHub issues, commit changes, and encourages insecure plaintext credential storage without clear confirmation gates.

Review before installing. Only use this skill when you intentionally want the full KB update workflow, not just translation. Keep Feishu and GitHub credentials in environment variables or a secret manager, prefer fine-grained GitHub tokens limited to issue creation, and require a preview/confirmation before Feishu updates, GitHub issue creation, document deletion/recreation, or git commits.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:111
Finding

Plaintext Storage of Feishu and GitHub Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 111–122
Vulnerability Type: Plaintext sensitive credential storage guidance
Risk Level: Medium

The skill explicitly permits sensitive Feishu and GitHub credentials to be stored in TOOLS.md, a plaintext project documentation file.

markdown
## Configuration Reference

Store these in `TOOLS.md` or as environment variables:

| Variable | Purpose |
|----------|---------|
| `FEISHU_APP_ID` | Feishu app ID |
| `FEISHU_APP_SECRET` | Feishu app secret |
| `FEISHU_WIKI_SPACE_ID` | Wiki space ID |
| `FEISHU_WIKI_NODE_TOKEN` | Wiki document node token |
| `GITHUB_REPO` | Target repo (e.g., `org/repo`) |
| `GITHUB_TOKEN` | GitHub PAT with repo scope |

Technical Analysis

FEISHU_APP_SECRET and GITHUB_TOKEN are authentication credentials. Storing them in an ordinary Markdown file exposes them to any user, process, indexing service, backup system, log collector, or version-control operation that can read or copy the project directory.

The guidance also describes the GitHub token as having repo scope. Depending on the token type and repository configuration, this may grant substantially more authority than the issue-creation workflow requires. The combination of plaintext storage and excessive token scope violates secret-management and least-privilege principles.

No hardcoded credentials were present in the audited files. The vulnerability is the unsafe configuration recommendation, which can cause users to persist real credentials insecurely.

Attack Path

  1. A user follows the skill's configuration instructions.
  2. The user writes a valid Feishu application secret or GitHub token into TOOLS.md.
  3. The plaintext file is accidentally committed, shared, backed up, indexed, included in diagnostic output, or read by another local process or user.
  4. An unauthorized party extracts the credential.
  5. The party authenticates to the cor ...[truncated 896 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to store secrets in TOOLS.md or any other project documentation file.
  2. Explicitly prohibit committing or recording authentication credentials in source-controlled files.
  3. Require credentials to be supplied at runtime through environment variables populated by an approved secret manager, operating-system credential store, or CI/CD secret facility.
  4. Use short-lived credentials where supported and establish routine rotation and immediate revocation procedures.
  5. Replace broadly scoped GitHub tokens with fine-grained tokens limited to the target repository and only the Issues permission required by this workflow.
  6. Restrict the Feishu application to the minimum API permissions and Wiki spaces necessary for the update operation.
  7. Add secret-scanning controls, pre-commit checks, and repository ignore rules as defense-in-depth measures.
  8. If credentials have already been placed in TOOLS.md, remove them from the file and version-control history, revoke or rotate them immediately, and review relevant access logs for misuse.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

Steps:

bash
# 1. Get tenant access token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is broad enough to trigger on ordinary translation or KB-update requests while embedding side effects such as Feishu updates, GitHub issue creation, and git commits. That creates a scope-escalation risk where a user asking for translation help could unintentionally authorize external writes and repository changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow performs multiple state-changing actions—editing local files, transmitting content to Feishu, creating GitHub issues, and committing to git—without an upfront warning or explicit consent gate. In an agent setting, this increases the chance of unauthorized or surprising actions that affect local state and external systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This step sends authentication material to an external service and is part of an automated workflow that can transmit document content to Feishu. While expected for the feature, it is still a real data-exfiltration surface because translated KB content and metadata may be sent off-host, especially if the skill is invoked too broadly or without clear consent.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash
# 1. Get tenant access token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \
  | jq -r '.tenant_access_token')

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This workflow can create GitHub issues via API, transmitting repository metadata and potentially sensitive KB-change details to an external platform. The risk is not the API itself but that the skill couples routine translation tasks with outbound network actions that may occur without sufficiently explicit user intent.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

If gh is not available, use the GitHub REST API directly with curl:

bash
curl -s -X POST \
  -H "Authorization: token $GITHUB_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/repos/$GITHUB_REPO/issues" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

curl -s -X POST
-H "Authorization: token $GITHUB_TOKEN"
-H "Accept: application/vnd.github+json"
"https://api.github.com/repos/$GITHUB_REPO/issues"
-d "{"title":"...","body":"..."}"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file includes a curl example that sends app_id and app_secret, which are sensitive credentials, but provides no accompanying warning about protecting secrets or avoiding exposure in shell history and shared terminals. Under the markdown-specific missing-warning rule, documentation that demonstrates credential use should disclose privacy or security implications when user or system secrets are involved.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feishu-api.md (reported line 6)May include surrounding context.

Authentication

bash
curl -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The notes recommend deleting and recreating a document as an update strategy, which is a destructive and potentially irreversible operation affecting user data. The markdown does not warn about possible data loss, permission implications, or the need to confirm backups before using this approach.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.