Feishu Agent Mesh

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:58 AM UTC
• Version: 0.1.3

Overview

The skill matches its Feishu agent-coordination purpose, but it asks users to centralize secrets and broad chat logs without enough safeguards.

Review before installing. Use this only in a controlled Feishu workspace, store all app secrets and bearer tokens in a secret manager rather than shared documents or JSON files, disable or minimize full-content message logging unless users and admins have approved it, restrict logs with retention and access controls, remove CLI fallback for production, and add request signing/replay protection plus narrow per-agent permissions before exposing the callback or relay.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: templates/accounts.example.json:1

Finding

Plaintext aggregation and sharing of high-value credentials and Agent session identifiers

Content

View full analysis

", "timeout_ms": 20000 } ``` ### Technical Analysis The design aggregates Feishu application secrets, webhook verification tokens, encryption keys, Relay bearer tokens, and Agent session identifiers into ordinary plaintext JSON files. No secret-manager integration, encryption-at-rest requirement, restrictive file permissions, repository exclusion, redaction policy, or separation of credentials by bot is provided. This creates a high-value credential bundle. A single accidental commit, chat attachment, exposed backup, ...[truncated 1555 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/feishu-callback-server.js:54

Finding

Excessive collection and replication of complete Feishu message content and user identifiers

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu-callback-server.js:69

Finding

Webhook authentication lacks signature verification and replay protection

Content

View full analysis

{ try { const raw = req.body; if (raw.type === 'url_verification') { return res.json({ challenge: raw.challenge }); } let eventBody = raw; if (raw.encrypt) { eventBody = decryptEvent(raw.encrypt); } if (eventBody.token !== VERIFICATION_TOKEN) { return res.status(403).end('invalid token'); } ``` ### Technical Analysis URL-verification requests are answered before verification of the supplied token or request origin. Normal event requests are authenticated only by comparing a static token carried in the parsed body. The implementation does not validate a request signature, timestamp, nonce, or source context. It also does not deduplicate event IDs. Consequently, it provides no effective replay protection. Anyone who learns the static token can generate accepted callback bodies, while previously accepted events can potentially be replayed. This implementation also conflicts with the deployment checklist, which tells operators to validate signatures but does not provide that protection in the shipped server. ### Attack Path 1. The callback is deployed on a public HTTPS endpoint as instructed. 2. An attacker obtains the static verification token through a leaked configuration, shared intake file, logs, or another compromised component. 3. The attacker constructs a message event containing the recovered token. 4. The attacker sends the forged event to `/feishu/callback`. 5. The server accepts the event because the static token matches. 6. The forged event is written to Bitable and may subsequently be consumed by the Relay as legitimate context or work. 7. The attacker can replay the same event because no event-ID deduplication or timestamp freshness check is enforced. ...[truncated 534 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/README.md:10

Finding

Unpinned and unnecessary npm dependencies create supply-chain exposure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/relay-config.example.json:1

Finding

Agent-to-Agent invocation channels are not constrained by least-privilege controls

Content

View full analysis

", "timeout_ms": 20000 } }, { "name": "xiaogu", "feishu_bot_id": "cli_yyyyy", "open_id": "ou_yyyyy", "capabilities": ["code", "data", "devops"], "invoke": { "type": "http", "url": "https://xiaogu.example.com/tools/invoke", "auth": "Bearer ", "timeout_ms": 20000 } } ] } ``` The surrounding documentation recommends HTTP `/tools/invoke`, permits CLI as a fallback, and permits Agents to use `sessions_send` to request work from other Agents. ### Technical Analysis The architecture creates remote command and capability channels into multiple Agents, including an Agent described as having code, data, and DevOps capabilities. The supplied design does not require: - Per-tool or per-operation allowlists. - Schema validation for invocation payloads. - Caller identity binding. - Per-Agent, per-chat, or per-capability credentials. - Sandboxing of invoked operations. - Mandatory approval for shell, filesystem, network, deployment, or credential operations. - Clear separation between untrusted chat content and executable Agent instructions. Because routing originates from chat messages, malicious or manipulated text can cross a trust boundary from Feishu into capable Agents. CLI fallback is especially risky because it can bypass st ...[truncated 1305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu-callback-server.js:116

Finding

Callback server contains trailing non-JavaScript text and cannot start as shipped

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code is narrowly focused on receiving Feishu callback events and appending message metadata/content to a Bitable table. While this partially aligns with the logging portion of the description, it does not implement the core advertised functionality: connecting multiple agents across servers, coordinating their discussions, handing off tasks, or pausing for human approval. Its primary behavior is webhook handling plus message logging, which is materially narrower and different from the declared orchestration blueprint.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly asks operators to collect and share highly sensitive secrets such as appSecret, encryptKey, verificationToken, session keys, and possibly database connection details, but provides no safeguards for secure transmission, storage, minimization, or access control. In a multi-agent, multi-host coordination setup, centralizing and team-sharing these credentials materially increases the chance of credential leakage, unauthorized bot control, log access, and compromise of connected Feishu, relay, or storage systems.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/README.md (reported line 14)May include surrounding context.

bash

cd skills/feishu-agent-mesh/scripts
npm install express body-parser node-fetch crypto
cp ../templates/.env.example .env   # optional helper
node feishu-callback-server.js

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs deployment of a callback server, use of environment variables for secrets, and network-facing event subscriptions, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, that omission can lead operators or automated runtimes to grant broader access than necessary, increasing the blast radius if the skill or referenced scripts are misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes logging every cross-agent message and synchronizing chat context across bots without warning about privacy, data minimization, retention, or user consent. In a multi-agent chat setting, that can expose sensitive user content, internal discussions, and identifiers across systems or operators beyond what participants expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks the user to provide highly sensitive bot secrets, verification tokens, encrypt keys, and invocation endpoints, then store them in configuration files, without any warning about secure collection, storage, rotation, or redaction. That creates a real risk of credential leakage through chat transcripts, logs, source control, or improperly protected config files, which could allow full bot impersonation or unauthorized access to Feishu integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The checklist explicitly directs operators to capture all message.receive events and persist chat context and logs, but it provides no guidance on data minimization, retention limits, consent, access control, or handling sensitive user content. In a multi-agent Feishu group-chat deployment, this creates a real privacy and security risk because routine operation can centralize large volumes of potentially sensitive conversations across bots and servers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly recommends logging chat identifiers, actor/target identifiers, task IDs, and message content payloads to Feishu Bitable and possibly databases, but it provides no minimization, consent, retention warning, or access-control guidance. In this skill context, the data comes from multi-agent group-chat collaboration, so logs may capture sensitive user prompts, internal files, and cross-agent decisions, increasing privacy, compliance, and insider-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The cold-storage guidance suggests copying audit data to Feishu Docs or Notion, which are broader collaboration surfaces than a controlled audit store and can significantly widen access to logged identifiers and message-derived content. In this agent-mesh skill, centralized cross-agent logs are likely to contain operational history and potentially sensitive conversation artifacts, so secondary syncing increases the chance of oversharing or accidental disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-callback-server.js (reported line 33)May include surrounding context.

js

if (tenantTokenCache.token && now < tenantTokenCache.expire) {
    return tenantTokenCache.token;
  }
  const resp = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ app_id: APP_ID, app_secret: APP_SECRET })

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The server persists raw inbound message content and identifiers into Feishu Bitable, creating unnecessary retention of potentially sensitive chat data. In the context of an agent-mesh chat integration, messages may contain credentials, internal tasks, or personal data, so broad logging increases confidentiality and compliance risk if the table is overexposed or retained too long.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code forwards message content and user/chat identifiers into persistent storage without any visible notice, consent mechanism, or comment indicating expected disclosure. In a multi-agent discussion skill, participants may assume they are chatting with bots in-group, not that all content is being separately retained in Bitable for audit, which raises privacy and governance concerns.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a blueprint for coordinating multiple OpenClaw agents in shared Feishu chats, including autonomous multi-turn discussions, task handoffs, cross-agent message logging, and pauses for human approval. This file only accepts Feishu callbacks, verifies/decrypts them, and writes message metadata/content into Bitable; it contains no logic for agent coordination, approvals, or cross-agent orchestration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The architecture guide mixes English headings with core descriptive content in Chinese, including the operational descriptions of components and message flow. This creates an implicit language constraint for users or maintainers who do not read Chinese, and the document does not offer an alternative language version or opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language instructions force a specific language for readers and operators, which can violate language or locale policy when no opt-in or justification is provided. There is no indication that the skill is intentionally region-specific or that alternative language support is available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction says humans reply with the Chinese terms 同意/拒绝, which imposes a specific language expectation in natural-language interaction. There is no indication that users may choose their preferred language or that the Chinese-only requirement is a documented, justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file is a markdown document, so natural-language policy checks apply. The operational content, triggers, and workflow steps are written only in Chinese, which can amount to forcing a specific language on users or operators without opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The opening comment frames the module as a minimal callback handler, which suggests basic receipt and acknowledgment of callbacks. In practice, the code also obtains tenant tokens and performs authenticated writes to a Bitable records API, adding a persistent logging side effect not reflected in the comment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file uses fixed English labels and bot names such as "coordinator" and "Specialist Bot A" without indicating that language is configurable or intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy issue, even in configuration examples.

Content

No source excerpt is available for this finding.