ClawHub
Back to skill

Security audit

全流程会议助理虾

Security checks for vulnerabilities and agentic risk

Overview

This meeting assistant has sensitive capabilities, but they are disclosed, purpose-aligned, and gated before sending messages externally.

Install only if you are comfortable processing meeting recordings locally, saving full transcripts in ./transcripts, and using a Feishu app that can read contacts and send bot messages. Use a dedicated least-privilege Feishu app, keep FEISHU_APP_SECRET protected, verify recipients and message bodies before confirming any send, and avoid using it for meetings that should not be shared through Feishu.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger list includes broad everyday phrases such as '这段录音' and '开会了', which can cause the skill to activate in contexts where the user did not intend meeting analysis or task distribution. In this skill, unintended invocation is more dangerous than usual because activation can lead to transcription, local persistence of meeting content, and eventual third-party message distribution if the workflow continues.

External Transmission

Medium
Category
Data Exfiltration
Content
```
  等待用户选择。

**优先级 2：飞书 Message API（curl 直接调用）**

仅当 openclaw-lark 插件不可用且用户选择不安装时使用。
Confidence
92% confidence
Finding
This section instructs the agent to obtain a Feishu tenant token and interact with remote APIs, enabling external transmission of sensitive meeting-derived data and directory lookups. Although the workflow includes a user-confirmation step, the skill still operationalizes exfiltration to a third-party service and use of powerful credentials, so compromise or misuse could expose confidential meeting content and employee identity data.

External Transmission

Medium
Category
Data Exfiltration
Content
3. **发送消息**：
```bash
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
95% confidence
Finding
The direct message-send API call is a true external transmission path for extracted action items, which may contain sensitive business, personnel, or project information. In this skill's context, the danger is amplified because the content is generated from potentially private meeting audio and then sent to third parties, creating confidentiality, integrity, and mistaken-recipient risks.

External Transmission

Medium
Category
Data Exfiltration
Content
**端点：** `POST /im/v1/messages?receive_id_type=open_id`

```bash
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
75% confidence
Finding
This documentation enables sending arbitrary message content and recipient identifiers to Feishu, which in the context of a meeting assistant may include transcripts, action items, names, and other sensitive business data. While the destination is legitimate, the skill context increases risk because extracted meeting content can contain confidential information and the document does not mention minimization, consent, recipient validation, or safeguards against accidental disclosure.

Static analysis

No suspicious patterns detected.