ClawHub
Back to skill

Security audit

Hire Feishu Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to add a Feishu bot, but it asks for a live app secret in chat and changes persistent OpenClaw gateway configuration without enough safety guidance.

Review this skill before installing. Use only least-privilege Feishu credentials, avoid pasting production secrets into chat, prefer replacing a placeholder locally, restrict permissions on ~/.openclaw/openclaw.json, back up and validate the JSON before changes, and restart the gateway only when you are ready for the new account and binding to take effect.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:21
Finding

Plaintext Collection and Reflection of a Feishu Application Secret

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-30, 41-47, and 72-74
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code Snippet

json
"{agentId}": {
  "appId": "{appId}",
  "appSecret": "{appSecret}"
}

The surrounding instructions require the agent to ask the user for the Feishu App Secret and subsequently output the final merged JSON fragment containing that value.

Technical Analysis

The Skill directs users to submit a live Feishu application secret through the conversational interface. It then embeds that value directly into a JSON configuration fragment and instructs the agent to return the merged fragment to the user.

This handling unnecessarily duplicates the secret across several locations:

  1. The user's original message.
  2. The model's active context.
  3. The generated response containing the merged JSON.
  4. Any conversation history, telemetry, debugging records, or audit logs retained by the hosting platform.
  5. Any clipboard, ticket, document, or messaging system into which the generated configuration is copied.

Although storing an application secret in the destination configuration may be required by the target application, collecting and reflecting it through a conversational channel expands its exposure surface. The Skill provides no redaction, secure-input mechanism, secret-manager integration, or warning against sharing production credentials.

Attack Path

  1. A user invokes the Skill to configure a Feishu agent.
  2. Following the Skill instructions, the agent asks the user to provide the Feishu App Secret.
  3. The user enters a valid production secret into the conversation.
  4. The secret is retained in the conversation context and may also be captured by platform logs or telemetry.
  5. The agent places the same secret into the final merged JSON response, creating another plaintext copy.
  6. An unauthorized perso ...[truncated 934 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not ask the user to submit the real App Secret through the conversation.
  2. Generate configuration with a non-secret placeholder, for example:
    json
    "appSecret": "${FEISHU_APP_SECRET}"
  3. Instruct the user to replace the placeholder locally using a protected editor, environment variable, or supported secret-management facility.
  4. Do not reproduce secret values in final responses, summaries, diagnostics, or error messages.
  5. Add an explicit warning that production credentials must not be pasted into chat.
  6. If direct configuration editing is supported, use a secure secret-input mechanism that suppresses display and prevents logging.
  7. Restrict permissions on ~/.openclaw/openclaw.json to the owning user and document that it contains sensitive credentials.
  8. Recommend immediate rotation of any secret previously shared through conversation history or other potentially retained channels.
  9. Where feasible, use short-lived credentials or a dedicated Feishu application with only the minimum API scopes necessary for the agent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly asks the user to provide a Feishu App Secret and then instructs them to place it into a local configuration file, but it gives no warning about the sensitivity of the credential, safe handling practices, or avoiding exposure in chat/logs. In an agent setting, requesting secrets without guardrails increases the risk of credential leakage through conversation history, screenshots, shared terminals, or accidental persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill tells the user to modify ~/.openclaw/openclaw.json and restart the gateway, which are system-impacting actions that can alter routing, credentials, and agent behavior, yet it provides no warning about backup, validation, rollback, or operational impact. Because the skill adds a new account binding and enables it after restart, mistakes or abuse could disrupt existing service or unintentionally activate a new externally connected agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file includes example appId and appSecret values for registering a Feishu bot, but it does not warn users that these are sensitive credentials or advise against committing real secrets to version control. Because markdown files should disclose behaviors affecting privacy or system integrity, the omission is a meaningful safety-warning gap.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.