ClawHub

Openclaw Feishu Setup

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Feishu setup guide with expected credential and public webhook exposure risks that users should handle carefully.

Use a dedicated Feishu app, grant only the listed permissions, restrict the app’s availability, protect ~/.openclaw/config.yaml from sharing or commits, enable verification/encryption values where available, monitor and close any public tunnel when finished, and rotate the App Secret if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guide instructs users to place App ID and App Secret directly into a local YAML config file, but does not clearly warn that the file contains sensitive credentials or recommend safer secret-handling practices. This can lead to accidental disclosure through world-readable files, backups, screenshots, shell history, or committing the config into source control, enabling unauthorized use of the Feishu app.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide recommends exposing a locally running Gateway to the public internet via ngrok, cloudflared, or Tailscale Funnel, but does not explain the security implications of publishing a local service. This increases attack surface and may allow unsolicited traffic, webhook abuse, misconfiguration exposure, or compromise if authentication and request validation are incomplete.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal