feishu-doc-extended

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:53 PM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it needs review because it persistently modifies a built-in Feishu tool and under-describes important behavior and data-handling risks.

Install only if you are comfortable manually modifying the built-in Feishu plugin and restarting the OpenClaw gateway. Treat returned image URLs, screenshots, and OCR text as sensitive Feishu document data, avoid sharing or logging them, and keep a way to revert the plugin edits. The publisher should clarify that OCR is manual, document the data-handling risks, and separate or remove the broad bundled Feishu schema to avoid confusion.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The description says the skill provides image download and OCR recognition. However, this code chunk exposes a much larger Feishu document API surface, including full document CRUD-style operations, block manipulation, table operations, image/file uploads, and text formatting. While image download (`get_image`) is present, OCR functionality is absent from the schema. This is a material description-behavior mismatch because the implemented interface enables broad document modification capabilities that are not disclosed, and one of the key declared capabilities (OCR) is not evidenced in the supplied code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description mentions image download and OCR recognition for Feishu documents. The provided code does implement image retrieval via Feishu's image API, which aligns with image download support. However, it also defines a readDoc function that concurrently fetches raw document content, document info, and document blocks from Feishu document APIs. That is a broader document-reading capability not disclosed in the description. No OCR behavior is visible in this chunk. Because the code accesses and reads document resources beyond the stated image download/OCR purpose, the description does not accurately represent the actual behavior.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The schema exposes a much broader capability set than the skill metadata advertises, including document read/write, creation, deletion, block manipulation, table editing, and file upload. This scope mismatch can mislead users and higher-level policy systems into granting or invoking powerful document-modification operations under the assumption the skill only handles image download and OCR, increasing the risk of unauthorized data modification or exfiltration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to retrieve temporary Feishu image URLs and run OCR on document images, but it does not warn that those URLs and resulting screenshots/text may expose sensitive document contents to local tools, logs, shell history, or other users with access to the environment. In the context of a document-extension skill, this increases the likelihood of inadvertent data leakage because users are being guided to extract and process potentially confidential document images outside the original access-control context.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest description says the skill provides both image download and OCR recognition. However, the file's actual implementation instructions only modify the Feishu plugin to support `get_image`, while the OCR step is performed manually by opening the URL in a browser, taking a screenshot, and running `tesseract` outside the skill. This is a semantic mismatch between the claimed skill capability and what the code/documentation actually implements.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation presents `image_ocr` as a supported feature that downloads images and performs OCR. Elsewhere, the only code change shown is a `get_image` action added to the Feishu plugin, and the OCR section instructs the user to manually use a browser and shell command. This actively misrepresents the implemented behavior rather than merely omitting details.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to retrieve temporary Feishu image URLs and open them in a browser, but does not warn that these links expose document-derived content and may carry access-sensitive tokens or leak via browser history, logs, screenshots, referrers, or shared terminals. In this context, the skill handles enterprise document data, so omitting safe-handling guidance increases the chance of inadvertent disclosure of sensitive content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The "write" action description states that it replaces the entire document content, but provides no warning, confirmation semantics, or safer alternative in the schema itself. In agentic contexts, terse destructive actions can be selected or invoked without the user appreciating that the operation is irreversible or broadly destructive.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The block deletion action enables irreversible content removal without any cautionary description or confirmation requirement. In this skill context, where broad document-editing capabilities already exceed the stated purpose, silent destructive primitives are more dangerous because users may not expect the tool to alter or delete document contents at all.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Deleting table rows can remove structured data permanently, yet the schema does not communicate that risk or require confirmation. Because table operations may affect multiple cells at once, accidental or unauthorized invocation can cause significant document corruption or data loss.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Deleting table columns can erase entire categories of structured information, but the schema lacks any warning about destructive impact. In practice this can result in broad data loss across many rows with a single call, making accidental misuse particularly harmful.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The schema includes generic remote/local file and image upload operations that are not disclosed by the stated skill purpose. Hidden upload capability expands the attack surface for sensitive local-file transmission or unreviewed remote content ingestion, especially when an agent may auto-select tools based on terse descriptions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The upload actions accept remote URLs and local file paths without schema-level warnings that file contents may be fetched from external sources or transmitted into Feishu. This creates privacy and data-handling risk, especially if an agent operates on local paths or user-provided URLs without making the transfer semantics explicit.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The manifest description is written entirely in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific context. This can conflict with language/locale policy guidance that requires opt-in or clear justification for a fixed locale.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This code retrieves a tenant access token and sends it in an Authorization header during an outbound HTTP request. The snippet contains no confirmation prompt, logging, or explanatory comment/docstring warning that credentials are being used for a network call.

Static analysis

No suspicious patterns detected.