VideoClaw Pro

• Outcome: Review
• Latest audit: May 28, 2026 · 2:14 PM UTC
• Version: 1.0.0

Overview

This skill’s Feishu read/write workflow is mostly disclosed, but it embeds reusable Feishu app credentials and can create persistent remote documents through a broad local command.

Review before installing. Only use this if you trust the publisher and the Feishu app credentials have been rotated or are intentionally scoped for this exact workflow. Expect it to read user-provided Feishu documents and create a new Feishu document through a local Python command; check the Feishu app permissions and where generated documents will be written.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill exposes the `exec` tool and explicitly instructs the agent to invoke a local Python CLI that reads remote Feishu links, which effectively grants undeclared network/file-access behavior through code execution. This is dangerous because reviewers and policy systems may underestimate the skill's real capabilities, and any prompt or document-controlled input flowing into that CLI could trigger unintended external access or broader execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond passive script generation and includes creating/writing Feishu documents, downloading/parsing Drive files, and directly calling Feishu APIs with embedded app credentials. That mismatch is high risk because users may provide sensitive internal links expecting limited processing, while the skill can exfiltrate, modify, or expand access to additional content using hidden authenticated functionality.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The CLI advertises and exposes Feishu document writing even though the skill metadata describes a workflow for reading rule/material documents and generating editing-script suggestions. This creates a scope mismatch that can enable unintended remote state changes, which is dangerous in agent environments because higher-level orchestration may trust the manifest and invoke the tool with more privileges than users expect.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implemented `write` command directly invokes `feishu_doc_writer(title, content)`, enabling remote modification of Feishu content outside the skill's stated read-oriented purpose. In an agent setting, this can be abused for unauthorized document creation, data tampering, or persistence of misleading content if an attacker can influence tool invocation or arguments.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module docstring states support for Feishu document read/write, which contradicts the described read-only skill behavior and normalizes broader capabilities than users and reviewers may expect. Misleading capability documentation increases the risk of unsafe tool use, weakens review controls, and can hide privilege creep in agent-integrated workflows.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata emphasizes document reading via Python CLI for generating editing scripts, but the library also exposes document creation and write capabilities. That expands the tool's authority beyond the stated read-focused purpose and enables remote state changes in the user's Feishu workspace without clear necessity or prominent consent boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Creating and modifying Feishu documents is a privileged capability that is not clearly justified by the stated purpose of reading rules/materials to generate script suggestions. In agent contexts, unnecessary write access increases the blast radius for misuse, prompt injection, or operator misunderstanding.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The file contains hardcoded Feishu `APP_ID` and `APP_SECRET`, exposing long-lived application credentials directly in source code. Anyone with code access can reuse them to obtain access tokens and act against the associated Feishu tenant within the app's granted permissions, causing unauthorized data access or document manipulation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code transmits the embedded application credentials to Feishu to obtain a tenant access token, enabling authenticated access to tenant resources. The network call itself uses HTTPS and is expected, but in the presence of hardcoded secrets and no user disclosure it operationalizes the secret exposure into active remote access.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The writer function performs remote document creation and content insertion in Feishu without an explicit user-facing warning or confirmation step. In an agent skill, undisclosed write operations are risky because they can alter external systems unexpectedly and may be triggered by ambiguous prompts or malicious document content influencing the workflow.

Static analysis

No suspicious patterns detected.