Security audit

Openclaw封装Skill

Security checks across malware telemetry and agentic risk

Overview

This skill matches its Xiaohongshu-to-Feishu crawler purpose, but it exposes credentials/session data and lets chat input reach shell execution and account-login flows too broadly.

Review before installing. Use only in an isolated environment after removing the bundled cookie, rotating/removing the exposed Feishu credentials, configuring your own private Feishu destination, and fixing the exec-based command invocation. Treat saved browser profiles, cookie.txt, and QR login screenshots as account credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The documentation embeds what appear to be real Feishu App ID, App Secret, and chat ID values instead of placeholders. Publishing credentials in a skill file can enable unauthorized use of the Feishu bot integration, message spoofing, abuse of API quotas, and possible access to organizational messaging workflows if the secrets are valid.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The crawler configuration contains Feishu application credentials that are unrelated to the stated purpose of Xiaohongshu crawling, which is a strong indicator of secret sprawl and unnecessary privilege exposure. Even if intended for notifications, embedding these values directly in source makes them recoverable by anyone with code access and expands the attack surface beyond the crawler itself.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: This module goes beyond cookie management and can trigger an external QR-code login flow via Feishu chat when a cookie is invalid. That expands the trust boundary by sending authentication artifacts through an external messaging channel, increasing the chance of account takeover, unintended login approval, or credential/session exposure if the chat is misconfigured or accessible by others.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The skill delegates work to a Python program that, per the comments/help text, can directly send crawler results and QR-code login prompts to a Feishu group. This creates an undeclared external data flow and side effect beyond a normal local command handler, so users may trigger transmission of scraped content or authentication prompts to third-party chat recipients without clear consent at execution time.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: User-controlled input is passed into a shell command via child_process.exec using string interpolation. Although the Python executable and script path are quoted, the command argument includes attacker-controlled keyword content inside double quotes, which can enable shell metacharacter expansion or command injection depending on the platform/shell, leading to arbitrary command execution under the skill's privileges.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill description advertises Feishu integration but does not clearly warn users that scraped content and login-related QR code images are transmitted to a Feishu group. This can cause unintended disclosure of search terms, scraped data, or authentication artifacts to a broader audience than the operator expects, especially in shared group chats.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The configuration section includes sensitive credential fields but does not warn users about secure storage, rotation, least-privilege scoping, or the risk of committing secrets to source control. In this context, that omission is more dangerous because the same section also shows concrete secret values, reinforcing unsafe secret-handling practices.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code captures a login-page screenshot containing a live QR code and sends it to a Feishu chat, which expands the trust boundary from the local machine to a messaging platform and all chat participants. If the chat is misconfigured, compromised, retained, or accessible by unintended users, the QR code or surrounding page content could enable unauthorized login attempts, disclose account-related information, or leak sensitive operational details.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Hardcoded application credentials are a real secret-management vulnerability because they can be extracted from the repository, logs, backups, or redistributed copies of the skill. An exposed Feishu app secret may allow unauthorized API access, impersonation of the application, abuse of integrated services, or lateral movement into connected enterprise workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code extracts all browser cookies from a persistent profile and writes them to disk as a plaintext cookie string. Cookies are bearer credentials for the target service, so any local user, malware, backup system, or accidental log/output exposure that accesses the file may hijack the authenticated session.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill automatically sends scraped Xiaohongshu results to a Feishu chat via `bot.send_notes_summary(...)` without explicit user confirmation, destination validation, or a warning that third-party content will be transmitted externally. In an agent-skill context, this can cause unintended disclosure of collected data to a hardcoded or caller-supplied chat, especially because the skill is designed to run from chat commands and may be triggered by users who do not understand where results are sent.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The cookie validation and auto-login flow accesses authentication/session material through `CookieManager.ensure_valid_cookie(target_chat)` without any visible notice, consent boundary, or safeguards shown in this file. In a skill that can be remotely triggered, silent handling of login cookies increases the risk of unauthorized session use, credential exposure through dependent modules, or unintended account actions tied to the browser session.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: upload_image() reads an arbitrary local file path and sends its contents to Feishu, which is an external service. In an agent/skill context, if image_path can be influenced by upstream input, this creates a data-exfiltration primitive for local files without any validation, path restriction, file-type verification, or user confirmation.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The module sends note titles, content excerpts, author names, likes, links, and error details to an external Feishu webhook. In a scraping context, this creates a real data-exfiltration/privacy risk if the scraped data is sensitive, regulated, or collected without operator awareness, especially since the webhook destination is configurable and can point to any external endpoint.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill behavior indicates crawler results are automatically pushed to a Feishu group, but the user-facing flow does not provide a clear warning or confirmation at the moment of execution. In a chat-agent context this is more dangerous because users may reasonably expect a reply in-channel, not silent forwarding of queried content and possibly associated login artifacts to an external group.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script explicitly persists a Playwright browser profile and tells the user that cookies will be reused by later automation. Those persisted cookies and related browser state can grant authenticated access to the account if the profile directory is copied, exposed, or reused by untrusted code, and the current messaging does not clearly warn the user about that sensitivity or storage risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: This code automatically loads an authentication cookie, derives the a1 identifier from it, and sends both credential-associated material and signed requests to an external service without any explicit consent prompt, warning, or boundary around secret handling. In an agent skill context, this is more dangerous because the skill can exfiltrate or misuse a user's authenticated session implicitly, especially when cookie loading is automatic and not clearly surfaced to the caller.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The browser is launched with launch_persistent_context using a reusable user_data_dir, which can load existing cookies, session tokens, and profile state and automatically present them to xiaohongshu.com. In a skill context, this can cause unintended account access, deanonymization, or transmission of authenticated browsing state without explicit user awareness or consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation explicitly describes automatically capturing a login QR code and sending it to a Feishu group, which creates account-operation and session-security risk. Anyone in that group who can scan the code may authenticate to the target Xiaohongshu account, and the doc does not warn about access control, trusted recipients, or operational safeguards.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The document includes a concrete Feishu App ID and App Secret in example configuration without stating that these are sensitive secrets that must not be committed or publicly shared. Exposed app credentials can allow unauthorized use of the Feishu application, abuse of bot capabilities, and further compromise of integrated messaging workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:124