openclaw自动化配置飞书，几乎不要人手动干预，测试成功

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

This Feishu automation skill is not clearly malicious, but it asks for sensitive Feishu authority and can generate credential-bearing code without enough user control or scoping.

Install only if you are comfortable reviewing generated code before use. Use a dedicated low-privilege Feishu test app, avoid tenant/admin-wide scopes, do not pass production tokens unless necessary, and check any files created under solutions for embedded secrets before committing or running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The configuration enables management-style capabilities such as drive_management, wiki_access, and permission_management while the declared OAuth scopes are read-only. This mismatch can cause the surrounding application or operators to assume stronger access exists, leading to insecure fallback behavior, overbroad code paths, or later permission expansion without proper review.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script advertises a testing and validation framework, but `test_solution()` returns simulated success without actually executing or validating the generated code. This can mislead users into trusting generated integration code that may be broken, insecure, or incomplete, increasing the chance of unsafe deployment.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill is designed to activate on broadly phrased Feishu-related problems rather than a narrowly scoped task, which can cause it to engage in contexts where the user did not intend autonomous troubleshooting or implementation. In an agent setting, over-broad triggering increases the chance of unnecessary credential handling, external API interaction, or unintended actions across Feishu resources.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes generated code directly into the workspace without interactive confirmation, review gating, or path safety controls beyond a fixed subdirectory. In an agent skill context, automatic file creation can overwrite expected project state or introduce unreviewed code that users may later execute.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The manifest describes the skill as automatically solving Feishu integration problems by researching, selecting solutions, and implementing automation approaches, which is an unusually broad and agentic scope. Combined with capabilities like web search, file operations, API integration, and authentication management, this can enable high-impact actions without clear task boundaries or user confirmation, increasing the chance of unsafe changes or misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest advertises sensitive capabilities including file operations and authentication management, but provides no user-facing warning, consent model, or restrictions on how credentials and local files are accessed. In a skill intended to automate third-party integrations, this materially raises the risk of credential exposure, unauthorized file modification, or silent persistence of secrets.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Feishu Integration Solver Skill Dependencies
lark-oapi>=1.4.8
requests>=2.31.0
python-dotenv>=1.0.0
pydantic>=2.0.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed and can also lead to non-reproducible builds. In a security-sensitive integration skill, this increases supply-chain risk because a later incompatible or compromised release could be pulled automatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Feishu Integration Solver Skill Dependencies
lark-oapi>=1.4.8
requests>=2.31.0
python-dotenv>=1.0.0
pydantic>=2.0.0

• Confidence: 97% confidence
• Finding: Using requests with only a minimum version constraint permits installation of versions that may include known vulnerabilities or future unreviewed changes. Because this skill appears to integrate with Feishu and likely performs outbound HTTP requests, dependency drift here is more dangerous than for a purely local package.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Feishu Integration Solver Skill Dependencies
lark-oapi>=1.4.8
requests>=2.31.0
python-dotenv>=1.0.0
pydantic>=2.0.0

• Confidence: 90% confidence
• Finding: An unpinned python-dotenv dependency creates reproducibility and supply-chain risk by allowing arbitrary newer releases to be installed without review. While lower impact than a networking library, environment-variable handling often touches secrets, so unexpected package behavior could still be security-relevant.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

lark-oapi>=1.4.8
requests>=2.31.0
python-dotenv>=1.0.0
pydantic>=2.0.0

• Confidence: 93% confidence
• Finding: Pydantic is used for parsing and validation, and leaving it unpinned can introduce vulnerable or behavior-changing releases into the runtime. Since validation libraries often process untrusted input, dependency drift can directly affect exploitability of parsing and denial-of-service issues.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The file declares requests without an upper bound or exact version, and the static analysis indicates multiple known advisories affecting that package family. In a Feishu integration skill, an HTTP client library is core functionality, so issues like credential leakage, TLS/verification flaws, or request handling bugs can expose tokens or compromise remote communications.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: The declared python-dotenv dependency is flagged for a file-overwrite issue involving symlink following in set_key. This is potentially exploitable if the skill writes .env files or related paths in a context where an attacker can influence filesystem links, though the risk depends on actual runtime usage.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Pydantic is flagged for known denial-of-service and parsing-related vulnerabilities, and validation libraries commonly process untrusted input from APIs or user requests. In an integration skill, malformed external data could trigger excessive resource consumption or parser edge cases, affecting availability or correctness.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.