Feishu Agent Mesh

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:58 AM UTC
• Version: 0.1.3

Overview

The skill matches its Feishu agent-coordination purpose, but it asks users to centralize secrets and broad chat logs without enough safeguards.

Review before installing. Use this only in a controlled Feishu workspace, store all app secrets and bearer tokens in a secret manager rather than shared documents or JSON files, disable or minimize full-content message logging unless users and admins have approved it, restrict logs with retention and access controls, remove CLI fallback for production, and add request signing/replay protection plus narrow per-agent permissions before exposing the callback or relay.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: templates/accounts.example.json:1
• Finding: Plaintext aggregation and sharing of high-value credentials and Agent session identifiers<![CDATA[ ## Vulnerability Details **File Location**: `templates/accounts.example.json:1-18, 52-61`; related instructions in `SKILL.md:22-35` and `references/info-collection-template.md:3-15` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code ```json { "feishuApps": [ { "label": "coordinator", "appId": "cli_your_app_id", "appSecret": "your_app_secret", "encryptKey": "your_encrypt_key", "verificationToken": "your_verification_token", "botName": "Coordinator Bot" }, { "label": "specialist-a", "appId": "cli_specialist_app_id", "appSecret": "specialist_app_secret", "encryptKey": "specialist_encrypt_key", "verificationToken": "specialist_verification_token", "botName": "Specialist Bot A" } ] } ``` ```json "agentSessions": [ { "agentId": "coordinator", "sessionKey": "agent:main:feishu:group:oc_primary_team" }, { "agentId": "specialist-a", "sessionKey": "agent:worker-a:feishu:group:oc_primary_team" } ] ``` The Skill directs operators to replace these placeholders with real values, save the result as an actual configuration file, and share the collected configuration with the team. The related Relay template also places bearer authentication material directly in JSON: ```json "invoke": { "type": "http", "url": "https://xiaogua.example.com/tools/invoke", "auth": "Bearer <token>", "timeout_ms": 20000 } ``` ### Technical Analysis The design aggregates Feishu application secrets, webhook verification tokens, encryption keys, Relay bearer tokens, and Agent session identifiers into ordinary plaintext JSON files. No secret-manager integration, encryption-at-rest requirement, restrictive file permissions, repository exclusion, redaction policy, or separation of credentials by bot is provided. This creates a high-value credential bundle. A single accidental commit, chat attachment, exposed backup, ...[truncated 1555 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace secret values in JSON with secret references such as environment-variable names or secret-manager resource identifiers. - Store application secrets, encryption keys, verification tokens, and bearer tokens in a managed secret service. - Prohibit sharing raw credentials through Feishu documents, chat, tickets, or source repositories. - Split credentials by bot and service so compromise of one configuration does not expose the entire mesh. - Apply restrictive filesystem permissions and run the Relay under a dedicated operating-system account. - Add explicit `.gitignore` rules for real configuration and environment files. - Add automated secret scanning to CI and pre-commit hooks. - Treat session identifiers as sensitive routing data and disclose them only to the Relay component that requires them. - Rotate any credential that has already been stored or shared using the documented plaintext workflow. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/feishu-callback-server.js:54
• Finding: Excessive collection and replication of complete Feishu message content and user identifiers<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-callback-server.js:54-63, 84-101`; related retention guidance in `references/logging-schema.md:1-18, 39-43` **Vulnerability Type**: Excessive data access and sensitive-content replication **Risk Level**: High ### Vulnerable Code ```js async function appendLog(record) { const token = await getTenantToken(); await fetch(`https://open.feishu.cn/open-apis/bitable/v1/apps/${BITABLE_APP_TOKEN}/tables/${BITABLE_TABLE_ID}/records`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}` }, body: JSON.stringify({ records: [{ fields: record }] }) }); } ``` ```js const event = eventBody.event || {}; if (event.type === 'message') { const openId = event.sender?.sender_id?.open_id || ''; const chatId = event.chat_id || ''; const msgId = event.message?.message_id || ''; const msgType = event.message?.message_type || ''; const msgContent = event.message?.content || ''; const ts = event.message?.create_time || Date.now(); const record = { [LOG_FIELDS_CHAT]: chatId, [LOG_FIELDS_TASK]: msgId, [LOG_FIELDS_ACTOR]: openId, [LOG_FIELDS_TARGET]: eventBody.header?.event_id || '', [LOG_FIELDS_ACTION]: msgType, [LOG_FIELDS_CONTENT]: msgContent, [LOG_FIELDS_TS]: new Date(Number(ts)).toISOString(), [LOG_FIELDS_STATUS]: 'received' }; await appendLog(record); } ``` ### Technical Analysis The callback extracts and transmits the complete message body together with stable user OpenIDs, chat IDs, message IDs, event IDs, message types, and timestamps. The destination is Feishu's official Bitable API, so this is declared integration traffic rather than covert exfiltration. Nevertheless, the amount of data collected exceeds the minimum required for the stated onboarding purpose of learning an `open_id` and establishing a session mapping. The logging guidance further recommends retaining payload cont ...[truncated 1609 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - During identity discovery, record only the minimum routing fields required, such as a pseudonymous identity reference and an approved chat identifier. - Do not store full message content by default. - Add explicit per-chat allowlists before processing or logging events. - Redact secrets, credentials, personal information, and sensitive links before persistence. - Use message summaries only when operationally required and document that requirement. - Implement field-level access control, encryption at rest, audit logging, and narrowly scoped Bitable permissions. - Define and automatically enforce short retention and deletion periods. - Avoid secondary exports to object storage, documents, or third-party systems by default. - Provide a deletion mechanism that removes all replicated copies associated with a message or user. - Obtain appropriate user and organizational approval before monitoring complete group-message content. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu-callback-server.js:69
• Finding: Webhook authentication lacks signature verification and replay protection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-callback-server.js:69-82` **Vulnerability Type**: Weak webhook authentication **Risk Level**: High ### Vulnerable Code ```js app.post('/feishu/callback', async (req, res) => { try { const raw = req.body; if (raw.type === 'url_verification') { return res.json({ challenge: raw.challenge }); } let eventBody = raw; if (raw.encrypt) { eventBody = decryptEvent(raw.encrypt); } if (eventBody.token !== VERIFICATION_TOKEN) { return res.status(403).end('invalid token'); } ``` ### Technical Analysis URL-verification requests are answered before verification of the supplied token or request origin. Normal event requests are authenticated only by comparing a static token carried in the parsed body. The implementation does not validate a request signature, timestamp, nonce, or source context. It also does not deduplicate event IDs. Consequently, it provides no effective replay protection. Anyone who learns the static token can generate accepted callback bodies, while previously accepted events can potentially be replayed. This implementation also conflicts with the deployment checklist, which tells operators to validate signatures but does not provide that protection in the shipped server. ### Attack Path 1. The callback is deployed on a public HTTPS endpoint as instructed. 2. An attacker obtains the static verification token through a leaked configuration, shared intake file, logs, or another compromised component. 3. The attacker constructs a message event containing the recovered token. 4. The attacker sends the forged event to `/feishu/callback`. 5. The server accepts the event because the static token matches. 6. The forged event is written to Bitable and may subsequently be consumed by the Relay as legitimate context or work. 7. The attacker can replay the same event because no event-ID deduplication or timestamp freshness check is enforced. ...[truncated 534 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Implement Feishu's current documented request-signature verification for every callback request before parsing or processing its event. - Validate URL-verification requests rather than returning arbitrary challenges before authentication. - Enforce timestamp freshness and reject stale requests. - Validate nonce or equivalent request metadata where supported. - Store processed event IDs and reject duplicates within a bounded replay window. - Use constant-time secret comparison where direct secret comparison remains necessary. - Place the endpoint behind a gateway with request-size limits, rate limits, and monitoring. - Reject malformed events and enforce a strict schema. - Keep verification secrets in a managed secret store and rotate them after suspected disclosure. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/README.md:10
• Finding: Unpinned and unnecessary npm dependencies create supply-chain exposure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/README.md:10-15`; duplicate instruction in `SKILL.md:48-50` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash cd skills/feishu-agent-mesh/scripts npm install express body-parser node-fetch crypto cp ../templates/.env.example .env # optional helper node feishu-callback-server.js ``` ### Technical Analysis The project does not include a reviewed `package.json` or lockfile and instructs operators to install mutable latest versions directly from the npm registry. This prevents reproducible builds and allows dependency or transitive-dependency behavior to change after the Skill has been audited. The command also requests the npm package named `crypto`, even though the script imports Node.js's built-in `crypto` module. Installing an unnecessary similarly named registry package adds avoidable package-confusion and lifecycle-script exposure. In addition, the referenced `templates/.env.example` file is absent from the supplied project tree, which encourages deployment-time improvisation. ### Attack Path 1. An operator follows the documented quick-start command. 2. npm resolves the latest available versions rather than reviewed versions. 3. A compromised package version, transitive dependency, or unnecessary registry package is downloaded. 4. npm executes package lifecycle scripts during installation where present. 5. Malicious code runs with the privileges of the deployment user and can access the working directory or deployment environment. 6. The resulting application differs from the version originally reviewed. ### Impact Assessment A successful dependency compromise can provide code execution under the deployment account. Depending on deployment practices, the attacker may access: - Feishu application secrets in environment variables. - Bitable identifiers and tenant tokens. - Relay configuration and bearer tokens. - Sourc ...[truncated 217 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add a reviewed `package.json` with explicit compatible versions. - Commit a lockfile and deploy with `npm ci`. - Remove the registry `crypto` dependency because Node.js supplies the required module. - Consider using built-in Node.js `fetch` in supported releases to reduce dependency count. - Review dependency provenance, lifecycle scripts, and transitive packages. - Use `npm ci --ignore-scripts` when application requirements permit. - Run dependency auditing and software-composition analysis in CI. - Maintain a documented supported Node.js version. - Add the missing environment-file template or remove the invalid copy instruction. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/relay-config.example.json:1
• Finding: Agent-to-Agent invocation channels are not constrained by least-privilege controls<![CDATA[ ## Vulnerability Details **File Location**: `scripts/relay-config.example.json:1-25`; related design instructions in `SKILL.md:59-67`, `references/architecture.md:11-15`, and `references/workflow-templates.md:22-29` **Vulnerability Type**: Overprivileged remote Agent invocation **Risk Level**: Medium ### Vulnerable Code ```json { "bots": [ { "name": "xiaogua", "feishu_bot_id": "cli_xxxxx", "open_id": "ou_xxxxx", "capabilities": ["breakdown", "product-thinking", "doc-gen"], "invoke": { "type": "http", "url": "https://xiaogua.example.com/tools/invoke", "auth": "Bearer <token>", "timeout_ms": 20000 } }, { "name": "xiaogu", "feishu_bot_id": "cli_yyyyy", "open_id": "ou_yyyyy", "capabilities": ["code", "data", "devops"], "invoke": { "type": "http", "url": "https://xiaogu.example.com/tools/invoke", "auth": "Bearer <token>", "timeout_ms": 20000 } } ] } ``` The surrounding documentation recommends HTTP `/tools/invoke`, permits CLI as a fallback, and permits Agents to use `sessions_send` to request work from other Agents. ### Technical Analysis The architecture creates remote command and capability channels into multiple Agents, including an Agent described as having code, data, and DevOps capabilities. The supplied design does not require: - Per-tool or per-operation allowlists. - Schema validation for invocation payloads. - Caller identity binding. - Per-Agent, per-chat, or per-capability credentials. - Sandboxing of invoked operations. - Mandatory approval for shell, filesystem, network, deployment, or credential operations. - Clear separation between untrusted chat content and executable Agent instructions. Because routing originates from chat messages, malicious or manipulated text can cross a trust boundary from Feishu into capable Agents. CLI fallback is especially risky because it can bypass st ...[truncated 1305 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove arbitrary CLI fallback from production designs. - Expose narrowly scoped, schema-validated tool operations rather than a general invocation endpoint. - Issue separate short-lived credentials per Relay, Agent, chat, and capability. - Bind authorization decisions to authenticated caller identity and approved task context. - Enforce per-Agent tool allowlists and deny shell, filesystem, deployment, and credential operations by default. - Require explicit human approval for high-impact actions. - Run worker Agents in isolated environments with restricted filesystem, network, and cloud permissions. - Treat all chat and cross-Agent content as untrusted data, not authoritative instructions. - Add prompt-injection filtering and policy enforcement outside the model. - Record invocation decisions without storing unnecessary sensitive payloads. - Apply rate limits, replay prevention, request signing, and endpoint allowlists. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu-callback-server.js:116
• Finding: Callback server contains trailing non-JavaScript text and cannot start as shipped<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-callback-server.js:116` **Vulnerability Type**: Invalid executable source file **Risk Level**: Medium ### Vulnerable Code ```js ```} Comment we added? yes. Need to ensure node-fetch import style? Since Node 18? we can mention to run with `node --experimental-modules`? But sample is enough. We included sample in skill earlier? but now TOT ensures zipped? Good enough though we need to mention to run with ` ``` ### Technical Analysis A Markdown fence and editorial prose are appended directly to the JavaScript source after the server startup code. The text is not a valid JavaScript comment or string and therefore causes parsing to fail. This is primarily an availability and release-integrity defect rather than evidence of malicious code. It is security-relevant because the documented callback and verification controls are unavailable when the service cannot start, and operators may apply unreviewed ad hoc edits or obtain replacement scripts from unsafe sources. ### Attack Path 1. An operator installs dependencies and runs the supplied file as documented. 2. Node.js parses the complete source file. 3. Parsing reaches the trailing Markdown and prose. 4. Node.js raises a syntax error before the callback server starts. 5. Feishu event handling and logging remain unavailable. 6. An operator may attempt an unreviewed workaround or download a replacement implementation. ### Impact Assessment The direct impact is denial of service for the supplied callback component. No callback events can be processed until the source is repaired. This can prevent onboarding, event verification, logging, and downstream Relay workflows. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the trailing Markdown fence and editorial prose from the JavaScript file. - Add a syntax-validation step such as `node --check` to CI. - Add an automated startup test for the callback server. - Define the module format and supported Node.js version in `package.json`. - Add tests covering URL verification, encrypted events, invalid authentication, valid messages, replay rejection, and Bitable failures. - Publish checksums or signed releases so operators do not need to obtain replacement scripts from unverified sources. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code is narrowly focused on receiving Feishu callback events and appending message metadata/content to a Bitable table. While this partially aligns with the logging portion of the description, it does not implement the core advertised functionality: connecting multiple agents across servers, coordinating their discussions, handing off tasks, or pausing for human approval. Its primary behavior is webhook handling plus message logging, which is materially narrower and different from the declared orchestration blueprint.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The template explicitly asks operators to collect and share highly sensitive secrets such as appSecret, encryptKey, verificationToken, session keys, and possibly database connection details, but provides no safeguards for secure transmission, storage, minimization, or access control. In a multi-agent, multi-host coordination setup, centralizing and team-sharing these credentials materially increases the chance of credential leakage, unauthorized bot control, log access, and compromise of connected Feishu, relay, or storage systems.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd skills/feishu-agent-mesh/scripts
npm install express body-parser node-fetch crypto
cp ../templates/.env.example .env   # optional helper
node feishu-callback-server.js
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs deployment of a callback server, use of environment variables for secrets, and network-facing event subscriptions, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that omission can lead operators or automated runtimes to grant broader access than necessary, increasing the blast radius if the skill or referenced scripts are misused.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes logging every cross-agent message and synchronizing chat context across bots without warning about privacy, data minimization, retention, or user consent. In a multi-agent chat setting, that can expose sensitive user content, internal discussions, and identifiers across systems or operators beyond what participants expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill asks the user to provide highly sensitive bot secrets, verification tokens, encrypt keys, and invocation endpoints, then store them in configuration files, without any warning about secure collection, storage, rotation, or redaction. That creates a real risk of credential leakage through chat transcripts, logs, source control, or improperly protected config files, which could allow full bot impersonation or unauthorized access to Feishu integrations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The checklist explicitly directs operators to capture all message.receive events and persist chat context and logs, but it provides no guidance on data minimization, retention limits, consent, access control, or handling sensitive user content. In a multi-agent Feishu group-chat deployment, this creates a real privacy and security risk because routine operation can centralize large volumes of potentially sensitive conversations across bots and servers.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explicitly recommends logging chat identifiers, actor/target identifiers, task IDs, and message content payloads to Feishu Bitable and possibly databases, but it provides no minimization, consent, retention warning, or access-control guidance. In this skill context, the data comes from multi-agent group-chat collaboration, so logs may capture sensitive user prompts, internal files, and cross-agent decisions, increasing privacy, compliance, and insider-exposure risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The cold-storage guidance suggests copying audit data to Feishu Docs or Notion, which are broader collaboration surfaces than a controlled audit store and can significantly widen access to logged identifiers and message-derived content. In this agent-mesh skill, centralized cross-agent logs are likely to contain operational history and potentially sensitive conversation artifacts, so secondary syncing increases the chance of oversharing or accidental disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

if (tenantTokenCache.token && now < tenantTokenCache.expire) {
    return tenantTokenCache.token;
  }
  const resp = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ app_id: APP_ID, app_secret: APP_SECRET })

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The server persists raw inbound message content and identifiers into Feishu Bitable, creating unnecessary retention of potentially sensitive chat data. In the context of an agent-mesh chat integration, messages may contain credentials, internal tasks, or personal data, so broad logging increases confidentiality and compliance risk if the table is overexposed or retained too long.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code forwards message content and user/chat identifiers into persistent storage without any visible notice, consent mechanism, or comment indicating expected disclosure. In a multi-agent discussion skill, participants may assume they are chatting with bots in-group, not that all content is being separately retained in Bitable for audit, which raises privacy and governance concerns.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a blueprint for coordinating multiple OpenClaw agents in shared Feishu chats, including autonomous multi-turn discussions, task handoffs, cross-agent message logging, and pauses for human approval. This file only accepts Feishu callbacks, verifies/decrypts them, and writes message metadata/content into Bitable; it contains no logic for agent coordination, approvals, or cross-agent orchestration.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The architecture guide mixes English headings with core descriptive content in Chinese, including the operational descriptions of components and message flow. This creates an implicit language constraint for users or maintainers who do not read Chinese, and the document does not offer an alternative language version or opt-in choice.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The natural-language instructions force a specific language for readers and operators, which can violate language or locale policy when no opt-in or justification is provided. There is no indication that the skill is intentionally region-specific or that alternative language support is available.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The instruction says humans reply with the Chinese terms `同意/拒绝`, which imposes a specific language expectation in natural-language interaction. There is no indication that users may choose their preferred language or that the Chinese-only requirement is a documented, justified regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This file is a markdown document, so natural-language policy checks apply. The operational content, triggers, and workflow steps are written only in Chinese, which can amount to forcing a specific language on users or operators without opt-in or an explicit region-specific justification.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The opening comment frames the module as a minimal callback handler, which suggests basic receipt and acknowledgment of callbacks. In practice, the code also obtains tenant tokens and performs authenticated writes to a Bitable records API, adding a persistent logging side effect not reflected in the comment.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file uses fixed English labels and bot names such as "coordinator" and "Specialist Bot A" without indicating that language is configurable or intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy issue, even in configuration examples.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/feishu-callback-server.js:24