ClawHub
Back to skill

Security audit

Send File

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent, but it can upload arbitrary local files or screenshots to Feishu without a clear confirmation gate and recommends plaintext credential persistence.

Review before installing. Use this only if you are comfortable with an agent uploading selected files to Feishu, and require the agent to confirm the exact file path and recipient before every send. Avoid storing FEISHU_APP_SECRET in shell startup files; use a credential manager or temporary per-command environment injection instead. Be especially careful with screenshots and generated reports because they may contain sensitive data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:26
Finding

Feishu Application Secret Stored in Plaintext Shell Startup Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–29
Vulnerability Type: Plaintext persistence of reusable application credentials
Risk Level: Medium

bash
# 永久配置（添加到 ~/.zshrc 或 ~/.bashrc）
echo "export FEISHU_APP_ID='cli_xxx'" >> ~/.zshrc
echo "export FEISHU_APP_SECRET='xxx'" >> ~/.zshrc
source ~/.zshrc

Technical Analysis

The Skill recommends writing the Feishu App ID and reusable App Secret directly into a shell startup file such as ~/.zshrc or ~/.bashrc. These files are plaintext, are loaded into interactive shell environments, and are not designed to provide secure secret storage.

This practice increases credential exposure through user-level processes, shell configuration backups, support bundles, accidental repository commits, synchronization services, overly permissive file permissions, or unintended environment-variable inheritance by child processes. The project does not contain a hardcoded production credential; the vulnerability arises from the documented credential-storage procedure.

Sending the credentials to Feishu's official tenant-token endpoint in scripts/send_feishu_file.py is necessary for the declared functionality. The security issue is their persistent plaintext storage, not their transmission to that official HTTPS endpoint.

Attack Path

  1. A user follows the documented permanent configuration procedure.
  2. The Feishu App Secret is written unencrypted to ~/.zshrc or ~/.bashrc.
  3. A malicious or compromised process operating as that user, an exposed backup, or an accidental configuration-file disclosure obtains the startup file.
  4. The attacker extracts the Feishu App ID and App Secret.
  5. The attacker submits those credentials to Feishu's tenant access-token endpoint.
  6. If the credentials remain valid and tenant controls permit the request, the attacker receives a tenant access token.
  7. The attacker exercises the permissions granted to the assoc ...[truncated 722 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the recommendation to store FEISHU_APP_SECRET directly in shell startup files.
  • Store the secret in an operating-system credential manager, enterprise secret manager, or another access-controlled secret store.
  • Inject credentials only into the process that needs them and avoid exporting them globally to every child process of an interactive shell.
  • If file-based storage is unavoidable, use a dedicated configuration file outside source repositories, restrict it to the owning user with mode 0600, and load it only immediately before invoking the sender.
  • Ensure shell startup files and secret files are excluded from source control, backups, diagnostic bundles, and synchronization where appropriate.
  • Rotate credentials that have already been stored in plaintext startup files.
  • Grant the Feishu application only the minimum API scopes required to upload and send files, and periodically review those scopes.
  • Avoid including credentials, tenant tokens, or authorization headers in logs and error messages.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Tainted flow: 'APP_ID' from os.environ.get (line 17, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/send_feishu_file.py (reported line 61)May include surrounding context.

python
def get_token():
    """获取 tenant_access_token"""
    url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    resp = requests.post(url, json={"app_id": APP_ID, "app_secret": APP_SECRET})
    data = resp.json()
    if data.get("code") != 0:
        raise Exception(f"获取 token 失败: {data}")

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

声明描述的是一个较通用的“发送文件到消息平台”能力，并强调支持多个平台以及对生成文档、本地文件、截图的优先级处理。但实际代码功能明显更窄：它只是一个飞书专用发送脚本，接受本地文件路径，上传到飞书后向指定 open_id 发送文件消息。代码没有任何多平台适配逻辑，也没有生成文档、查找截图、按优先级选择内容等实现。因此描述与实际行为存在实质性不一致。另一方面，代码访问飞书 API、读取环境变量凭证和本地文件，这些都属于实现该发送功能的正常细节，而非额外未声明的风险能力。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明的核心能力是“发送文件到消息平台”，但该脚本的实际功能只是发送前检查：验证文件是否存在、计算文件大小、根据平台输出大小限制警告，并最终打印可发送提示。代码中没有任何调用飞书、Telegram、Discord、Signal 等平台 API 或 CLI 的逻辑，因此其主要行为与声明的主要目的存在实质性不符。此外，描述中提到的内容来源优先级（生成文档、本地文件、截图）在代码中完全未体现。虽然平台名称与文件发送场景相关，但仅属于校验辅助，不足以支撑已声明的发送能力。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs use of environment variables and external network access to Feishu, but it declares no explicit tool scope or permissions. In an agent environment, missing scope declarations can allow the skill to be invoked without clear user/admin awareness of its ability to read secrets and transmit files externally, increasing the chance of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed to upload local or generated files to external messaging platforms, but it does not prominently warn about privacy and confidentiality risks before transmission. This is dangerous because users may unintentionally send sensitive workspace files, personal documents, or internal reports to third-party services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The credential setup advises persisting app secrets in shell startup files without warning about exposure risks. Secrets stored in plaintext dotfiles may be leaked through backups, shared home directories, terminal history workflows, or accidental disclosure to other tools and processes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document gives conflicting instructions about whether Feishu sending must use a Python script or the message tool. In an agent setting, contradictory guidance can cause the model to choose the more powerful execution path unnecessarily, leading to unsafe file handling, unexpected code execution, or unintended external transfer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The screenshot workflow omits any warning that screen captures may include passwords, tokens, messages, customer data, or other sensitive on-screen information. Because the next step is external transmission, this can directly cause accidental disclosure of highly sensitive content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
import json

# 1. 获取 token
token_resp = requests.post(
    "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
    json={"app_id": APP_ID, "app_secret": APP_SECRET}
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
import json

# 1. 获取 token
token_resp = requests.post(
    "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
    json={"app_id": APP_ID, "app_secret": APP_SECRET}
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
import json

# 1. 获取 token
token_resp = requests.post(
    "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
    json={"app_id": APP_ID, "app_secret": APP_SECRET}
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This call uploads a local file's contents to Feishu, which is a genuine external data transmission. In this skill context, that is the core behavior, but it becomes security-relevant because the skill can operate on local/generated files and the documentation lacks strong consent and privacy safeguards, creating real exfiltration risk if the wrong file is selected or inferred.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
# 2. 上传文件
with open(file_path, 'rb') as f:
    upload_resp = requests.post(
        "https://open.feishu.cn/open-apis/im/v1/files",
        headers={"Authorization": f"Bearer {token}"},
        files={'file': (filename, f, mime_type)},

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
file_key = upload_resp.json()["data"]["file_key"]

# 3. 发送文件消息
requests.post(
    "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
    headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
    json={

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's docstring and all user-facing CLI messages are written only in Chinese, which imposes a specific language on users without any opt-in or configuration. Under the stated policy, locale or language constraints should be optional or explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_feishu_file.py (reported line 61)May include surrounding context.

python
def get_token():
    """获取 tenant_access_token"""
    url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
    resp = requests.post(url, json={"app_id": APP_ID, "app_secret": APP_SECRET})
    data = resp.json()
    if data.get("code") != 0:
        raise Exception(f"获取 token 失败: {data}")

Tainted flow: 'data' from requests.post (line 62, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/send_feishu_file.py (reported line 85)May include surrounding context.

python
files = {'file': (safe_filename, f, mime_type)}
        # 统一使用 stream 类型，避免飞书 API 对特定类型的限制
        data = {'file_type': 'stream', 'file_name': safe_filename}
        resp = requests.post(url, headers=headers, files=files, data=data)
    
    result = resp.json()
    if result.get("code") != 0:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This skill sends files to an external messaging platform, so it can exfiltrate local documents to arbitrary Feishu recipients if invoked with a sensitive file path and open_id. In an agent-skill context, the danger is elevated because the script has no recipient allowlist, file sensitivity checks, or explicit confirmation gate before transmitting data off-host.

Content

Scanner excerpt · scripts/send_feishu_file.py (reported line 106)May include surrounding context.

python
"msg_type": "file",
        "content": json.dumps({"file_key": file_key})
    }
    resp = requests.post(url, headers=headers, json=data)
    result = resp.json()
    if result.get("code") != 0:
        raise Exception(f"发送消息失败: {result}")

Tainted flow: 'data' from requests.post (line 62, network input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/send_feishu_file.py (reported line 106)May include surrounding context.

python
"msg_type": "file",
        "content": json.dumps({"file_key": file_key})
    }
    resp = requests.post(url, headers=headers, json=data)
    result = resp.json()
    if result.get("code") != 0:
        raise Exception(f"发送消息失败: {result}")

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

模块文档和命令行用法在 L004/L115 都声明脚本接受可选的 [caption] 参数，且 main() 在 L121 读取了该值；但后续上传与发送消息逻辑仅发送文件，不会把 caption 写入任何请求。这属于文档/接口说明对实际行为的误导，用户会以为脚本会附带文本说明。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's comments and all user-facing usage/help text are written in Chinese, and there is no indication that the skill is intentionally region-specific or that users can opt into another language. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.