ClawHub
Back to skill

Security audit

Feishu Docx PowerWrite

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Feishu/Lark document-writing helper whose document mutation behavior is expected, disclosed, and limited to user-provided Feishu access.

Install only if you intend to let your agent write to Feishu/Lark Docx documents using your own Feishu app permissions. Review document targets before append operations, and use replace mode only when you explicitly want the whole document overwritten.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Self-Modification

High
Category
Rogue Agent
Content
description: High-quality Feishu/Lark Docx writing via OpenClaw. Use when you want to turn Markdown into well-formatted Feishu Docx (headings, lists, nesting, code blocks) using feishu_docx_write_markdown; includes safe workflows, templates, and troubleshooting. Trigger on Feishu doc/docx links, “write to Feishu doc”, “generate a Feishu doc”, “append/replace docx”, “convert markdown to feishu doc”, or when users want consistently good doc formatting.
---

# Feishu Docx PowerWrite

This skill focuses on **reliably writing great-looking Feishu Docx** using OpenClaw’s Feishu OpenAPI tools.
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill metadata declares very broad trigger phrases such as any Feishu doc/docx link, generic requests like 'generate a Feishu doc,' and broad formatting-related intents. Overly broad activation can cause the agent to invoke this skill in contexts where document writes were not the user's primary intent, increasing the chance of unintended external side effects such as appending to or replacing documents.

Static analysis

No suspicious patterns detected.