Feishu Group Ops

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:18 PM UTC
• Version: 1.0.1

Overview

This appears to be a real Feishu group-management skill, but it handles powerful credentials and billing in unsafe ways that users should review carefully before installing.

Install only after reviewing whether you trust this publisher with Feishu app credentials and live group-management authority. The publisher should remove the raw get_token flow, stop printing or passing bearer tokens through stdout/argv, rotate and remove the embedded SkillPay API key, document SkillPay identity sharing, and make billing fail closed before this is suitable for normal use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu.py:136

Finding

Hard-Coded SkillPay API Credential in Distributed Source Code

Content

View full analysis

Vulnerability Details

File Location: scripts/feishu.py, lines 136–139
Vulnerability Type: Hard-coded service credential
Risk Level: High

Vulnerable Code

python

def _skillpay_headers():
    api_key = "sk_e8d7b86db13746fdbdd3a02d34f118a276d32629b3ef8bc55838d68f560e2c1b"
    if not api_key:
    return {"X-API-Key": api_key}

Technical Analysis

A SkillPay API key is embedded directly in the distributed Python source. Anyone able to download, inspect, or otherwise access the Skill package can recover this credential without executing the code.

The exact privileges assigned to the key cannot be determined from the repository. However, the code uses it as an X-API-Key when calling SkillPay billing and payment-link endpoints. An attacker could therefore attempt to invoke any SkillPay API operation authorized for that key.

The snippet also contains an indentation error because the return statement is not indented beneath the if statement. As shipped, this causes a parse-time IndentationError and prevents the script from executing. This availability defect does not protect the exposed credential because it remains readable in plaintext.

Attack Path

1. An attacker obtains the publicly distributed or locally installed Skill package.
2. The attacker opens scripts/feishu.py and extracts the plaintext API key.
3. The attacker sends requests to SkillPay with the recovered value in the X-API-Key header.
4. If the key remains active, the attacker can exercise whatever billing or account privileges SkillPay assigned to it.
5. The resulting activity may be attributed to the legitimate Skill publisher.

Impact Assessment

Potential impact includes unauthorized SkillPay API access, fraudulent or manipulated billing activity, service abuse, quota consumption, and reputational or financial harm to the credential owner. The maximum scope is limited to the permissions assigned to the ex ...[truncated 163 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed SkillPay API key.
2. Remove the credential from the source code and repository history.
3. Load the replacement credential from a protected secret manager or, at minimum, a dedicated environment variable.
4. Configure the key with the least possible privileges and restrict it by endpoint, tenant, origin, or network location where supported.
5. Add secret scanning to pre-commit hooks and CI pipelines.
6. Correct the indentation and add a syntax-compilation test such as python3 -m py_compile scripts/feishu.py.
7. Do not publish the replacement credential in examples, documentation, logs, or generated packages.

other

Warning

• Location: scripts/feishu.py:141

Finding

Caller Feishu Identifiers Disclosed to an External Billing Service

Content

View full analysis

Vulnerability Details

File Location: scripts/feishu.py, lines 141–164 and 186–196
Related Documentation: SKILL.md, line 132
Vulnerability Type: Third-party identity disclosure and excessive data sharing
Risk Level: Medium

Vulnerable Code

python

def require_payment(user_id, command):
    """Write operation precondition. Emits a payment link and exits with code 2 when funds are insufficient."""
    free = FREE_COMMANDS.copy()
    extra = os.environ.get("SKILLPAY_FREE_CMDS", "")
    if extra:
        free.update(c.strip() for c in extra.split(","))
    if command in free:
        return

    if not user_id:
        err("Write operations require --user_id for billing")

    try:
        result = http(
            "POST",
            f"{SKILLPAY_BASE}/api/v1/billing/charge",
            body={
                "user_id":  user_id,
                "skill_id": SKILLPAY_SKILL_ID,
                "amount":   PRICE_PER_WRITE,
            },
            headers=_skillpay_headers()
        )

python

def _get_payment_link(user_id, amount=5.0):
    """Generate a payment link through POST /api/v1/billing/payment-link."""
    try:
        result = http(
            "POST",
            f"{SKILLPAY_BASE}/api/v1/billing/payment-link",
            body={"user_id": user_id, "amount": amount},
            headers=_skillpay_headers()
        )
        return result.get("payment_url", "https://skillpay.me")
    except SystemExit:
        return "https://skillpay.me"

The project documentation states that --user_id is the caller's Feishu open_id. Consequently, each paid write attempt transmits an organization-linked Feishu identifier to https://skillpay.me, together with the Skill identifier and requested amount.

Technical Analysis

External billing is part of the declared commercial behavior in SKILL.md, so the transfer is not covert. Nevert ...[truncated 1567 chars]

Remediation

View remediation

Remediation Suggestions

1. Obtain explicit, informed user or administrator consent before sending Feishu identifiers to SkillPay.
2. Document the billing provider, transmitted fields, purpose, retention period, deletion process, and privacy terms in both README.md and SKILL.md.
3. Replace the Feishu open_id with a random, service-specific billing identifier that cannot be reversed or reused across services.
4. Keep the mapping between Feishu users and billing identities within the trusted local or first-party environment.
5. Make third-party billing an optional, isolated component rather than a mandatory part of core group management.
6. Apply data minimization and transmit no group names, message text, member lists, access tokens, or other Feishu content to the billing provider.
7. Establish contractual and technical retention, deletion, encryption, and access-control requirements for the billing service.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu.py:303

Finding

Feishu Tenant Access Token Exposed Through Standard Output and Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/feishu.py, lines 303–308 and 414–418
Related Documentation: SKILL.md, lines 69–73 and 94–129
Vulnerability Type: Insecure secret handling
Risk Level: High

Vulnerable Code

python

def cmd_get_token(a):
    app_id, app_secret = load_credentials()
    r = feishu("POST", "/auth/v3/tenant_access_token/internal",
               body={"app_id": app_id, "app_secret": app_secret})
    print(json.dumps({"token": r["tenant_access_token"],
                      "expires_in": r.get("expire", 7200)}, ensure_ascii=False))

python

def main():
    p = argparse.ArgumentParser(description="Feishu group management tool")
    p.add_argument("command", choices=list(COMMANDS.keys()))
    p.add_argument("--token");            p.add_argument("--user_id")
    p.add_argument("--name");             p.add_argument("--chat_id")
    p.add_argument("--target_user_id");   p.add_argument("--user_ids")
    p.add_argument("--text")

SKILL.md explicitly instructs the Agent to capture the token from get_token and pass it to later commands using --token TOKEN.

Technical Analysis

Tenant access tokens are bearer credentials. Printing the token to standard output can place it in Agent transcripts, execution logs, telemetry, debugging output, or orchestration records. Passing it as a command-line argument creates additional exposure through process listings, audit systems, shell history, and process-monitoring tools.

Anyone who acquires the token can submit Feishu API requests under the application's granted scopes until the token expires or is revoked. The documentation indicates an expected validity period of approximately two hours.

The syntax error elsewhere in the script currently prevents command execution, but this insecure token flow is the documented design and becomes exploitable once the syntax error is fixed.

Attack Path

1. The ...[truncated 1062 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the public get_token command and never return raw access tokens to the Agent.
2. Acquire and use the tenant token internally within each command.
3. If token reuse is required, store it in a memory-only cache owned by a restricted helper process.
4. Use protected inter-process communication, restricted file descriptors, or an operating-system credential facility instead of command-line arguments.
5. Redact authorization headers and token-shaped values from logs, transcripts, telemetry, and exception messages.
6. Apply restrictive process and file permissions to any unavoidable local token cache.
7. Request only the Feishu scopes required for the operation being performed.
8. Add tests that verify no token appears in standard output, standard error, or process arguments.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu.py:141

Finding

Billing Enforcement Fails Open When SkillPay Is Unavailable

Content

View full analysis

Vulnerability Details

File Location: scripts/feishu.py, lines 141–167
Vulnerability Type: Fail-open authorization and billing control
Risk Level: Medium

Vulnerable Code

python

def require_payment(user_id, command):
    """Write operation precondition. Emits a payment link and exits with code 2 when funds are insufficient."""
    free = FREE_COMMANDS.copy()
    extra = os.environ.get("SKILLPAY_FREE_CMDS", "")
    if extra:
        free.update(c.strip() for c in extra.split(","))
    if command in free:
        return

    if not user_id:
        err("Write operations require --user_id for billing")

    try:
        result = http(
            "POST",
            f"{SKILLPAY_BASE}/api/v1/billing/charge",
            body={
                "user_id":  user_id,
                "skill_id": SKILLPAY_SKILL_ID,
                "amount":   PRICE_PER_WRITE,
            },
            headers=_skillpay_headers()
        )
    except SystemExit:
        return  # Allow the operation when the billing service is unavailable

    if result.get("success"):
        return

Technical Analysis

The shared http() function calls err() for HTTP and network errors, and err() terminates execution by raising SystemExit. require_payment() catches that same exception and returns normally. The caller interprets a normal return as successful billing authorization and proceeds with the Feishu write.

This converts billing-provider errors, invalid credentials, DNS failures, connection failures, timeouts, and non-success HTTP responses into authorization to perform a paid operation. Security and billing controls should fail closed when positive authorization cannot be established.

This issue affects billing enforcement rather than Feishu authorization itself. Feishu still evaluates the supplied tenant token and application permissions. The current parse-time indentation error prev ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

1. Fail closed: abort the write whenever billing authorization cannot be positively verified.
2. Replace SystemExit-based network handling with typed exceptions that distinguish transport failures, provider errors, insufficient balance, and malformed responses.
3. Require a signed or otherwise verifiable charge-authorization result before executing a Feishu write.
4. Validate the response schema and treat missing, malformed, or unexpected fields as denial.
5. Use idempotency keys so retries cannot create duplicate charges.
6. Define an explicit retry policy with bounded exponential backoff; after retries fail, stop and tell the user that billing is temporarily unavailable.
7. Record auditable transaction identifiers while avoiding sensitive token or user-data logging.
8. Add tests covering DNS failure, timeout, HTTP errors, invalid API keys, malformed JSON, insufficient funds, and duplicate retries.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The public description understates sensitive behavior: the skill can retrieve tenant access tokens, inspect app permissions, and appears to rely on billing credentials not disclosed in the summary. Description-behavior mismatches undermine informed consent and can conceal credential-handling or monetization behavior from users and reviewers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Exposing a command whose purpose is to fetch and output a Feishu tenant access token creates a direct credential-access surface. If the token is shown to the model, user, logs, or downstream tools, it can be reused to access Feishu APIs beyond the immediate requested action.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

| Operation | Command | Billed |
|-----------|---------|--------|
| Check permissions | `check_permissions` | Free |
| Get access token | `get_token` | Free |
| List all groups | `list_chats` | Free |
| Find group by name | `find_chat --name` | Free |
| List group members | `list_members --chat_id` | Free |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The command reference explicitly documents obtaining a tenant access token from auto-read credentials, reinforcing that the skill can surface reusable authentication material. Any leakage of that token through command output, traces, or prompt context could enable unauthorized API access.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

# Check app permissions
python3 {baseDir}/scripts/feishu.py check_permissions

# Get tenant access token (auto-reads credentials)
python3 {baseDir}/scripts/feishu.py get_token

# List all groups

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

--token TOKEN --chat_id CHAT_ID \
  --target_user_id TARGET_UID --user_id CALLER_UID

# Send message to group (billed)
python3 {baseDir}/scripts/feishu.py send_message \
  --token TOKEN --chat_id CHAT_ID --text "MESSAGE" --user_id CALLER_UID

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A hardcoded SkillPay API key is embedded in the source and used for outbound billing requests. Anyone who can read the skill code can extract and abuse that key to impersonate the service, issue unauthorized billing requests, or interact with the third-party billing backend outside intended controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This code prints the Feishu tenant_access_token directly to output, handing a reusable bearer credential to whoever invokes the skill. Because the token can be used outside the script against Feishu APIs, an attacker can bypass all intended command restrictions and perform any action allowed by the app's granted scopes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises destructive actions such as removing members, renaming groups, creating groups, and sending messages without warning that these operations can affect real organizational communications and membership. In an agent skill context, lack of explicit confirmation/safety guidance increases the chance of accidental or unauthorized changes triggered through natural-language requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The installation section instructs users to set FEISHU_APP_ID and FEISHU_APP_SECRET but provides no warning that these are sensitive credentials that grant API access to chat, membership, and messaging capabilities. In a skill ecosystem where users may copy commands casually, missing secret-handling guidance raises the risk of credential leakage, insecure storage, or oversharing in logs/screenshots.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope despite requiring environment access, file reads, and network access. That omission weakens sandboxing and review because operators and users cannot readily tell that the skill can read local credentials and call external APIs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

| Rename group | `rename_chat` | 0.002 USDT |
| Create group | `create_chat` | 0.002 USDT |

When a write operation returns `{"error": "payment_required", ...}`: stop, show the `message` field to the user, and wait for them to top up before retrying.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example includes identifiable employee names and role information in a member-listing response without any privacy notice, minimization guidance, or indication that the data is fictional. In a group-management skill, examples normalize disclosure of internal roster information, which can encourage overexposure of personal data and increase privacy/compliance risk if copied into real deployments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill 'Reads Feishu credentials automatically from OpenClaw config — no manual setup needed.' However, this example documents a first-use flow where the assistant asks the user to manually create a Feishu app and perform setup steps in the browser. That is an active contradiction between documented intent and described behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script explicitly documents a get_token command that retrieves a raw Feishu tenant access token, which exceeds the stated user-facing scope of group management. Exposing bearer tokens to the caller enables arbitrary API access within the token's permissions, effectively turning the skill into a credential-exfiltration proxy rather than a bounded admin tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/feishu.py (reported line 49)May include surrounding context.

python

FEISHU_BASE       = "https://open.feishu.cn/open-apis"
SKILLPAY_BASE     = "https://skillpay.me"
SKILLPAY_SKILL_ID = "4e5f95c0-67f2-4093-950c-a4b705107778"
PRICE_PER_WRITE   = float(os.environ.get("SKILLPAY_PRICE", "0.002"))
FREE_COMMANDS     = {"check_permissions", "get_token", "find_chat",
                     "list_chats", "find_user", "list_members"}

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill automatically reads Feishu app credentials from the user's local OpenClaw configuration, expanding its access to secrets beyond what is necessary for a minimally scoped action handler. In combination with the token export behavior, this makes the local credential store an implicit trust boundary the skill can leverage to obtain organization-wide API access without explicit user approval at runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends user_id, skill identifier, and billing amount to a third-party billing service during write operations without clear runtime disclosure or consent. This creates an unnecessary privacy and trust risk because user identity and activity metadata are transmitted off-platform as a side effect of normal tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing examples and instructions in this file are presented only in Chinese, and the document does not indicate that the skill supports language selection or is intentionally limited to a Chinese-speaking audience. Per SQP-3, forcing a specific language without user opt-in can violate language/locale policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.