ClawHub
Back to skill

Security audit

飞书发文件

Security checks for vulnerabilities and agentic risk

Overview

This skill is for sending files to Feishu/Lark, but it handles local files and app secrets in ways users should review before installing.

Review this skill before installing. Use it only for files you intentionally want to upload to Feishu/Lark, avoid broad or sensitive local paths, and do not pass app secrets on the command line or have an agent grep local config files for them. Prefer a scoped secret manager or protected environment variables and confirm the recipient before sending files to users or groups.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent/user to read Feishu appId and appSecret from a local configuration file using grep, which expands the skill from sending files into harvesting secrets from the host. In an agent environment with broad file access, this creates a clear path to retrieve sensitive credentials and then use them for outbound API actions, increasing the risk of credential exposure and misuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation claims API keys should be configured securely via environment variables, but the actual workflow passes app_secret on the command line and elsewhere instructs users to read it from config files. Command-line secrets are commonly exposed through shell history, process listings, logs, and agent transcripts, so the guidance is internally inconsistent and unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill is designed to upload local files and images to Feishu, but the documentation does not clearly warn that local data will leave the host and be transmitted to a third-party service. In agent workflows, this omission can cause users to unknowingly exfiltrate sensitive local files or internal reports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples show secret-bearing commands with app_id and app_secret supplied directly in shell invocations, without warning that such usage can leak secrets via history, process inspection, or captured transcripts. This is especially risky in shared hosts and agent platforms where command output and execution context may be logged.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This documentation instructs uploading local files to an external Feishu endpoint, which is expected for the skill's purpose, but it still constitutes external transmission of potentially sensitive local data. Because the skill also discusses local paths like /root/myfiles and encourages automated sending, the context makes accidental data exfiltration more likely unless explicit consent and path/content restrictions are enforced.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
-d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['app_access_token'])")
# ...
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=stream" \
  -F "file_name=<文件名>" \