ClawHub
Back to skill

Security audit

Feishu Agent Mesh

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Feishu relay blueprint, but it handles bot secrets and chat logs that need careful operator controls.

Install only if you are authorized to operate a Feishu relay for the relevant chats. Keep real app secrets out of source control, use HTTPS, restrict callback access to approved chats and bots, protect the Bitable/log store, set retention/redaction rules, pin dependencies, and fix the sample callback script before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs operators to handle highly sensitive secrets (`app_secret`, verification token, encrypt key) and to deploy a network-accessible callback service, but it declares no permissions or security boundaries. This omission can cause unsafe deployment assumptions, improper review, and overbroad secret/network access in production, increasing the chance of credential exposure or unvetted external connectivity.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill description frames the capability as chat coordination, but the body also directs users to expose a Feishu webhook endpoint, process inbound events, decrypt callback payloads, obtain tenant access tokens, and write logs to Feishu Bitable. That behavioral expansion materially changes the trust model by introducing internet-facing webhook handling and privileged credential use that may bypass user scrutiny or normal approval for externally reachable services.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The handler logs every incoming Feishu message event, including message content and sender identifiers, into Bitable without filtering for only cross-agent traffic or approval checkpoints. In the context of a multi-agent chat skill, this broad collection increases privacy exposure and can capture unrelated human conversations or sensitive data beyond the stated purpose.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The code transmits message contents, chat IDs, and user identifiers into a secondary data store without any visible notice, minimization, or policy enforcement. In a group-chat agent mesh, this can silently expand the audience and retention of sensitive conversations, making accidental data exposure more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/feishu-callback-server.js:24