ClawHub
Back to skill

Security audit

飞书发票报销机器人管理

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for managing a Feishu invoice reimbursement bot, but it has review-worthy weaknesses around shell command construction, automatic package installation, and possible credential exposure.

Install only if you trust the publisher and will run it in a controlled bot environment. Set BOT_DIR to a trusted, simple path without shell metacharacters, review scripts/manage.py before using start or config, avoid showing raw .env values in chat or logs, and understand that the bot can create reimbursement approvals through Feishu.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f"cd {BOT_DIR} && "
        f"python3 {ORCHESTRATOR} >> {LOG_FILE} 2>&1"
    )
    result = subprocess.run(
        ["tmux", "new-session", "-d", "-s", TMUX_SESSION, cmd],
        capture_output=True, text=True,
    )
Confidence
97% confidence
Finding
result = subprocess.run( ["tmux", "new-session", "-d", "-s", TMUX_SESSION, cmd], capture_output=True, text=True, )

Tainted flow: 'cmd' from os.environ.get (line 61, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
f"cd {BOT_DIR} && "
        f"python3 {ORCHESTRATOR} >> {LOG_FILE} 2>&1"
    )
    result = subprocess.run(
        ["tmux", "new-session", "-d", "-s", TMUX_SESSION, cmd],
        capture_output=True, text=True,
    )
Confidence
99% confidence
Finding
result = subprocess.run( ["tmux", "new-session", "-d", "-s", TMUX_SESSION, cmd], capture_output=True, text=True, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly requires sensitive environment variables, reads and edits files under BOT_DIR, and instructs the agent to execute shell commands such as tmux, python3, pip, npm, and lark-cli, yet it declares no explicit permissions model. This creates a real security issue because users and the platform cannot accurately understand or constrain what the skill is allowed to do, despite it handling secrets and operational control of a local bot.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script self-installs tmux via Homebrew, which expands its scope from bot management to system package management. In an agent skill context, this is more dangerous because invoking the skill can alter the host system, pull software from external sources, and create unexpected supply-chain and privilege risks.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The configuration display claims to hide secrets but only masks lines containing the literal string 'SECRET', so tokens, API keys, passwords, app IDs, webhook URLs, and other sensitive values may be printed in cleartext. In a bot-management skill that handles .env files and external service auth, this substantially increases the risk of credential disclosure through terminal output, logs, or chat-visible responses.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.