ClawHub
Back to skill

Security audit

Feishu File Sender Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to send files to Feishu/Lark, but it handles credentials and shell execution in ways users should review carefully before installing.

Only use this with a least-privilege Feishu/Lark app, non-sensitive test files first, and a clearly confirmed recipient. Avoid putting app_secret in command lines or transcripts, do not print secrets, and replace the shown exec pattern with structured arguments and secret loading from a protected location.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:214
Finding

Shell Command Injection Through Unquoted Parameter Interpolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:158
Finding

Feishu Application Secret Exposed Through Terminal Output and Command-Line Arguments

Content
View full analysis
[file_name] # 发送图片 python3 scripts/send_image.py [domain] ``` The complete AI-agent integration example similarly embeds the secret in the executed command: ```python exec(f""" python3 /path/to/scripts/send_file.py \\ {file_path} \\ {user_open_id} \\ {app_id} \\ {app_secret} \\ {custom_filename} """) ``` ### Technical Analysis The `grep` command can print `appSecret` directly to the terminal and therefore to terminal capture, AI-agent transcripts, execution telemetry, or logs. Passing `app_secret` as a command-line argument creates additional exposure. Depending on the operating system and agent environment, command arguments may be visible through process inspection, shell history, audit facilities, debugging output, command logging, or retained conversation records. An application secret is an authentication credential used to obtain a Feishu tenant access token. It should not be displayed or transported through observable command-line arguments. Neither printing the secret nor placing it on the command line is necessary for the Skill's declared functionality. ### Attack Path 1. A user or AI agent follows the quick-start instructions and prints the Feishu configuration fields. 2. The application secret appears in terminal output or an agent transcript. 3. Alternatively, the agent passes the secret in the command line when invoking one of the documented s ...[truncated 954 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

bash
# 获取 tenant_access_token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
| python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

# 上传文件获取 file_key
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=stream" \
  -F "file_name=report.html" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to send local files and provide app credentials to an external Feishu/Lark API, but it does not clearly warn that file contents and secrets leave the local environment. In an agent setting, this omission can cause users to disclose sensitive files or credentials without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill text claims applicability to document conversion, format conversion, and content extraction even though the described implementation is only for uploading and sending files/images to Feishu/Lark. This scope mismatch can mislead an agent or user into supplying unrelated local documents for processing or transmission, increasing the chance of inappropriate data handling or execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The examples pass app_secret directly as a command-line argument, which can be exposed via shell history, process listings, audit logs, and agent telemetry. This is a common credential-handling flaw that can leak the Feishu/Lark application secret to other local users or monitoring systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manual curl example includes app_secret directly in an inline request body without guidance on secret handling. While the API call itself is legitimate, documenting this pattern without warnings encourages insecure operational practices and increases the chance of credential leakage through shell history, logs, and copied transcripts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This command sends app credentials to Feishu's external API to obtain a tenant access token. Although that is expected for the product's function, it is still a real data-exfiltration boundary because sensitive credentials leave the local environment; in an agent context, that requires explicit disclosure and consent.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

bash
# 获取 tenant_access_token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This command transmits a message payload referencing an uploaded file to the external Feishu API. Because the skill's purpose is to send files/messages externally, this is intended behavior, but it is still security-relevant since it can disclose local work product or sensitive communications if triggered without clear user awareness.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

bash
# 发送文件消息
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"<OPEN_ID>\",\"msg_type\":\"file\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The credential verification example sends app_id and app_secret to an external endpoint, which is operationally valid but still transmits sensitive data off-host. Without accompanying warnings, users may test production secrets in insecure shells or shared agent sessions.

Content

Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.

bash
# 验证凭证
curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"your_app_id","app_secret":"your_app_secret"}'