ClawHub
Back to skill

Security audit

飞书发文件

Security checks for vulnerabilities and agentic risk

Overview

This skill is for sending files to Feishu/Lark, but it handles local files and app secrets in ways users should review before installing.

Review this skill before installing. Use it only for files you intentionally want to upload to Feishu/Lark, avoid broad or sensitive local paths, and do not pass app secrets on the command line or have an agent grep local config files for them. Prefer a scoped secret manager or protected environment variables and confirm the recipient before sending files to users or groups.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent/user to read Feishu appId and appSecret from a local configuration file using grep, which expands the skill from sending files into harvesting secrets from the host. In an agent environment with broad file access, this creates a clear path to retrieve sensitive credentials and then use them for outbound API actions, increasing the risk of credential exposure and misuse.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The documentation claims API keys should be configured securely via environment variables, but the actual workflow passes app_secret on the command line and elsewhere instructs users to read it from config files. Command-line secrets are commonly exposed through shell history, process listings, logs, and agent transcripts, so the guidance is internally inconsistent and unsafe.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill is designed to upload local files and images to Feishu, but the documentation does not clearly warn that local data will leave the host and be transmitted to a third-party service. In agent workflows, this omission can cause users to unknowingly exfiltrate sensitive local files or internal reports.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The examples show secret-bearing commands with app_id and app_secret supplied directly in shell invocations, without warning that such usage can leak secrets via history, process inspection, or captured transcripts. This is especially risky in shared hosts and agent platforms where command output and execution context may be logged.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['app_access_token'])")
# ...
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=stream" \
  -F "file_name=<文件名>" \
Confidence
78% confidence
Finding
This documentation instructs uploading local files to an external Feishu endpoint, which is expected for the skill's purpose, but it still constitutes external transmission of potentially sensitive local data. Because the skill also discusses local paths like /root/myfiles and encourages automated sending, the context makes accidental data exfiltration more likely unless explicit consent and path/content restrictions are enforced.

Static analysis

No suspicious patterns detected.