Security audit

agent-creator-feishu

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent agent-creation purpose, but it gives high-impact OpenClaw and Feishu configuration instructions without enough validation or containment.

Review this skill before installing. It appears intended to automate OpenClaw agent setup, not to hide malicious behavior, but only use it in a trusted admin context. Validate agent names and group IDs strictly, review exact OpenClaw and Feishu configuration changes before execution, and avoid writing free-form user prompts or generated behavior text into shared MEMORY.md.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:55
Finding: Unsanitized Agent Names and Group IDs Are Interpolated into Shell Commands and Filesystem Paths
Content: View full analysis
--workspace ~/.openclaw/workspace- # 2. Write configuration files (IDENTITY.md / SOUL.md / AGENTS.md / SKILL.md / config.json) # 3. Ensure the group is in the allowlist (refer to the allowlist configuration in GUIDE.md) # 4. Bind to the group chat openclaw agents bind --agent --bind "feishu:" ``` The same unsafe substitution patterns appear in `references/AGENT-CREATION-GUIDE.md`: ```bash openclaw agents add --workspace ~/.openclaw/workspace- ``` ```bash openclaw agents bind --agent --bind "feishu:" ``` ```bash tail -f /tmp/openclaw/openclaw-$(date +%Y-%m-%d).log | grep -E "" ``` ### Technical Analysis The Agent name and group ID originate from fields supplied through the Agent blueprint. The Skill instructs the executing Agent to substitute these values directly into shell commands without specifying validation, escaping, or safe process invocation. The unquoted `` value is used both as a command-line argument and as part of a filesystem path. If the generated command is executed through a shell, shell metacharacters can terminate or extend the intended command. A value beginning with a hyphen may also be interpreted as an additional command-line option. Path separators or traversal components can cause the workspace path to resolve outside the intended `~/.openclaw/` workspace root. Although the group ID is placed inside double quotes, a malicious value containing a quote and shell syntax can escape the intended argument if it is substituted verbatim. The logging command additionally passes the Agent name to `grep -E`, ca ...[truncated 1864 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:69
Finding: Unconstrained Update to Shared Persistent Agent Memory
Content: View full analysis
Remediation: View remediation
/`. 3. Use a strict schema containing only necessary operational metadata, for example: - Validated Agent identifier - Validated group identifier - Creation timestamp - Deployment result - Configuration version 4. Do not persist raw prompts, blueprint notes, behavioral instructions, generated persona text, or other free-form user-controlled content. 5. Require explicit, separate user approval before writing to any shared or long-term memory store. Display the exact proposed record before the write. 6. Encode data using a structured serializer rather than concatenating Markdown. Validate field lengths and reject control characters or instruction-like content where it is not required. 7. Apply filesystem permissions that prevent newly created Agents and ordinary group users from modifying shared workspace memory. 8. If a shared audit trail is operationally necessary, use an append-only structured deployment log that is not loaded as Agent instructions or conversational memory. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match common conversational requests like creating a bot or adding one to a group, which can cause the skill to activate in situations where the user did not explicitly intend to invoke workspace-changing or binding actions. In this skill’s context, that is more dangerous because the workflow ultimately creates agents, assigns admin privileges from sender metadata, and binds to Feishu groups, so accidental invocation could lead to unauthorized or premature configuration changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: All user-facing instructions and invocation examples are written in Chinese, and the skill presents itself as operating in that language without any opt-in or alternative locale guidance. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document is written as a creation template that prescribes Chinese headings and content placeholders such as '创建指南', '我是谁', and other required sections for agent metadata and behavior files. Because the guide does not indicate that Chinese is optional or region-specific, it imposes a locale choice on users without opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template instruction is written as a direct imperative in Chinese ('用这个模板...也可以直接填好发回来') and the entire file provides no option to use another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.