Openclaw Feishu Setup

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This is a coherent Feishu bot setup guide, but users should secure the public callback endpoint and protect the app secret.

Install only if you intend to connect OpenClaw to Feishu. Before exposing the gateway, configure callback verification, use message encryption where Feishu supports it, keep the app secret out of shared files, restrict config permissions, limit Feishu app permissions and availability, and avoid unrestricted public tunnels for production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Public Gateway Exposure with Optional Callback Authentication and Plaintext Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–32, 36–46, and 60–76
Vulnerability Type: Publicly exposed service with optional callback verification and plaintext secret storage
Risk Level: Medium

Evidence

The documented configuration stores the Feishu application secret directly in the OpenClaw YAML configuration and treats the encryption key and verification token as optional:

yaml

plugins:
  entries:
    - plugin: openclaw-feishu
      config:
        appId: "cli_xxxxxxxxxx"
        appSecret: "xxxxxxxxxxxxxx"
        encryptKey: "xxxx"          # Optional message-encryption key
        verificationToken: "xxxx"   # Optional callback-verification token

The instructions then recommend exposing the local gateway through public tunneling services:

bash

ngrok http 3000

bash

cloudflared tunnel --url http://localhost:3000

bash

tailscale funnel 3000

Technical Analysis

The setup guide permits users to publish the gateway on the Internet without requiring callback authentication or message encryption. If the separately installed openclaw-feishu plugin does not independently enforce Feishu callback signatures, timestamps, nonces, and replay protection, an exposed endpoint may accept forged or replayed event requests.

The application secret is also documented as a plaintext value inside ~/.openclaw/config.yaml. No restrictive file permissions, secret manager, environment-based injection, or operating-system credential store is required. Consequently, another local account, backup process, support utility, or compromised application with read access to that file could recover the credential.

The project contains no implementation of the gateway or plugin, so successful callback forgery cannot be established solely from this repository. The confirmed issue is the insecure deployment guidance: public exposure is recommended while the releva ...[truncated 1454 chars]

Remediation

View remediation

Remediation Suggestions

1. Make verificationToken mandatory before permitting the gateway to accept public traffic.
2. Require encryptKey when encrypted Feishu events are enabled and fail closed when decryption or verification fails.
3. Document mandatory verification of Feishu signatures, timestamps, nonces, and challenge requests.
4. Add replay protection by rejecting stale timestamps and previously processed event identifiers or nonces.
5. Bind the gateway to localhost and place it behind a hardened reverse proxy that enforces TLS, request-size limits, rate limiting, and strict route allowlisting.
6. Restrict tunnel access where supported instead of publishing an unrestricted endpoint.
7. Store appSecret, verification tokens, and encryption keys in a secret manager, operating-system credential store, or protected environment injection mechanism rather than directly in YAML.
8. If file-based storage is unavoidable, require ownership by the gateway account and permissions equivalent to 0600.
9. Rotate any credential that may have been exposed and use the minimum Feishu permissions required for the bot.
10. Add a deployment validation step that refuses startup when authentication controls are absent on a publicly reachable listener.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown instructions, headings, and user-facing guidance are all written in Chinese, and the file does not indicate that the user can choose another language. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest text specifies the skill as "(Chinese)" and includes "chinese" as a keyword, which indicates a language constraint. There is no accompanying note that this is optional, user-selectable, or justified as a region-specific tool, so it appears to impose a locale choice without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.