Create a new agent in FeiShu

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.1

Overview

This is a setup guide for Feishu multi-agent OpenClaw routing; it uses credentials and persistent config, but those steps are disclosed and fit the stated purpose.

Before installing, review each command, back up ~/.openclaw/openclaw.json, confirm the Feishu account IDs and agent IDs, and avoid pasting app secrets or provider keys into chat or logs. Only configure remote memory embeddings for workspace content you are comfortable sending to that provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs reading an API key from a local auth profile and writing it into configuration, but only says not to echo secrets to users; it does not require redaction in logs, avoidance of shell history exposure, or use of a secret store/environment variable. In an agent skill context, this can cause credential disclosure through command transcripts, config files, debug output, or persistent state if the agent follows the steps verbatim.

VirusTotal

66/66 vendors flagged this skill as clean.