ClawHub
Back to skill

Security audit

feishu-send-file

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate file-sending purpose, but it should be reviewed because it directs agents to read and pass Feishu app secrets directly while sending local files externally.

Review before installing. Use this only with explicitly chosen files and recipients, avoid letting the agent discover or print Feishu secrets from local config files, and prefer secure secret injection over command-line app_secret arguments. Treat any callback_url use as unsafe unless the destination and payload are clearly explained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

Low
Confidence
76% confidence
Finding
The skill documents a callback_url input without explaining what data may be sent to it or imposing any restrictions. In an agent context, this can enable silent transmission of execution results, metadata, or file-handling outcomes to an arbitrary external endpoint supplied by a user or prompt, creating an SSRF/data-exfiltration risk surface.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The documentation instructs the agent to read /root/.skill-platform/skill-platform.json and extract appId/appSecret from a local credential store. That expands the skill from file sending into credential discovery, encouraging access to sensitive secrets unrelated to the immediate user-provided file operation and increasing the chance of credential exposure through terminal history, logs, or downstream prompts.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The document says secrets should be protected, but its examples pass app_secret on the command line and show extracting it from config files. Command-line arguments are commonly exposed via shell history, process listings, audit logs, and debugging output, so this guidance materially increases secret leakage risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill normalizes direct handling of Feishu app credentials in examples and operational instructions without strong user-facing safeguards. In this context, the skill is designed to send local files to an external service, so encouraging direct disclosure and reuse of app credentials heightens the risk of account compromise and unauthorized outbound messaging if those secrets are captured or reused.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
A callback_url parameter implies outbound delivery of execution results or metadata to a third-party endpoint, but the document provides no warning, validation rules, or privacy constraints. In a skill that already supports file-related operations and external API communication, this omission makes unintended data disclosure more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['app_access_token'])")
# ...
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=stream" \
  -F "file_name=<文件名>" \
Confidence
93% confidence
Finding
The skill explicitly uploads local files to Feishu via external HTTP requests. External transmission is expected for a file-sending skill, but it is still security-relevant because local paths such as /root/myfiles and arbitrary selected content may be exfiltrated off-host if the agent is induced to send sensitive files or if destination/recipient parameters are attacker-controlled.

Static analysis

No suspicious patterns detected.