OpenClaw安全审计与防护

• Outcome: Review
• Latest audit: May 28, 2026 · 2:42 PM UTC
• Version: 1.0.0

Overview

This security-audit skill is broadly coherent, but it sends sensitive audit and approval data to fixed Feishu accounts using embedded credentials that installers cannot control.

Do not install this in a sensitive environment as-is. Only use it after replacing the embedded Feishu credentials and recipient/chat IDs with your own secure runtime configuration, disabling external reporting by default, adding redaction and opt-in controls, and fixing confirmation replies so they must reference a unique request ID.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that imply file I/O, shell execution, and network access, but no explicit permissions are declared. This creates a transparency and policy-enforcement gap: users and the platform cannot accurately assess or constrain what the skill may do, especially given its ability to read/write audit files and contact Feishu services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior expands beyond local auditing into outbound messaging, alerting, confirmation polling, and external Feishu integration, including mention of hardcoded identifiers/secrets. This mismatch is dangerous because a user may invoke what appears to be a local security tool while it actually exfiltrates operational data to third-party services and potentially embeds sensitive credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes Feishu application credentials and uses them to obtain an access token for a third-party API. Embedded secrets can be extracted by anyone with file or repository access, enabling unauthorized message sending, impersonation, and continued external access until the secrets are rotated.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code authenticates to Feishu and transmits audit report contents externally, which can include sensitive operational details. In an audit/security skill, audit logs often contain privileged actions, timestamps, and context, so silent outbound delivery materially increases confidentiality risk, especially when the metadata does not clearly disclose third-party transmission.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Realtime alerting sends operation details to Feishu immediately upon detecting high-risk activity, creating an undisclosed external notification channel. Because the function sends details before any confirmation workflow completes, it may leak sensitive incident data or user activity to a third party even for mistaken or unverified events.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script is presented as a local operation-chain analysis engine, but it also performs outbound messaging to Feishu containing alert details. That creates an undeclared data egress path for audit/context data, which is security-relevant because audit logs often contain sensitive operational metadata.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes Feishu app credentials, a user identifier, and a chat identifier directly in source code, allowing anyone with code access to reuse those secrets to obtain tenant access tokens and query or send messages. In the context of an audit/confirmation skill, this creates unnecessary privileged outbound access and materially increases the blast radius if the file is leaked, copied, or logged.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The confirmation logic does not bind a user reply to a specific confirmation request; instead, any recent message from the configured user containing words like '确认', 'ok', or 'yes' can confirm every pending action. This breaks the two-phase confirmation model and can lead to accidental or unintended approval of high-risk operations, especially when multiple requests are pending or unrelated chat messages exist.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script contains hard-coded Feishu app credentials and a fixed recipient identifier, which gives the code an embedded external messaging capability independent of local audit analysis. If the file is exposed, copied, or reused, those secrets can be abused to send messages or access Feishu APIs, and the monitoring tool becomes an implicit exfiltration/notification channel rather than a purely local audit component.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds hardcoded Feishu app credentials and a target user ID directly in source code, then uses them to authenticate and send outbound messages. In a local integrity-check tool, this creates secret exposure risk and gives the code an undisclosed remote-notification capability that could be abused to exfiltrate file-change information or repurposed by anyone who obtains the script.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation describes only local hash-based tamper detection, but the implementation also performs external authentication and sends remote alerts. This mismatch reduces user awareness and informed consent, making the hidden network behavior more dangerous in a security-sensitive auditing tool.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The module promises that external URLs must be reviewed before execution, but the implementation only classifies URLs and optionally sends an alert; it does not actually gate, block, or mediate any later fetch or execution step. In a security skill, this mismatch can create dangerous operator trust and lead downstream components to assume enforcement exists when it does not.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds Feishu application credentials and a fixed recipient identifier directly in source code, then uses them to send messages externally. Hardcoded secrets are easily leaked via source control, packaging, logs, or reuse, and the fixed exfiltration destination is especially dangerous in a tool that processes potentially sensitive URLs and audit events.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file performs external authentication and outbound IM messaging that are not clearly aligned with the stated URL whitelist helper purpose. In the context of an audit/protection skill, unexpected network side effects increase the risk of covert data disclosure and make security review harder because checking a URL can trigger off-box transmission.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation conditions are very broad and overlap with ordinary tasks such as querying history, analyzing risk, scanning content, or checking files. In an agent environment, this can cause the skill to trigger in many routine contexts and gain access to sensitive inputs or execute monitoring logic when the user did not intend to invoke it.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script not only stores credentials in code but actively uses them for outbound authentication without any warning or consent mechanism. This combines secret exposure with covert external connectivity, making it easier for a compromised or repurposed script to exfiltrate information or abuse the messaging account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends audit data to Feishu over external APIs without clear disclosure that potentially sensitive user or system information leaves the local environment. In the context of a security audit tool, this is more dangerous because audit records commonly contain exactly the forensic and operational details attackers or unauthorized parties would want.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded APP_ID and APP_SECRET embed long-lived credentials directly in source code, making them recoverable by anyone with code access and usable to obtain access tokens. In this skill context, the credentials are then used for external messaging, enabling unauthorized API use, alert spoofing, or data exfiltration via the bound Feishu application.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends audit-derived details, including operation names, timestamps, context identifiers, and free-form detail fields, to an external Feishu endpoint without any visible consent, disclosure, or sanitization. In an audit/protection skill, these records are especially sensitive because they may reveal security events, credential access activity, or user behavior that should remain local or tightly controlled.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The embedded Feishu credentials and identifiers enable undisclosed outbound communication and access to chat data, which is a real security and privacy issue independent of user interface disclosure. Because the skill is positioned as a security audit/protection tool, hidden external messaging capabilities are more dangerous: operators may trust it with sensitive operations while unaware that privileged third-party API access is built in.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The helper sends operation names and details to Feishu messages, which may expose sensitive actions or context to an external service without explicit notice or data-minimization controls. In an audit/confirmation workflow, those details can include high-risk or confidential operational metadata, creating avoidable privacy and information-leakage risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends audit-derived operational metadata to Feishu without any runtime notice, consent mechanism, or clear user-facing disclosure. Even if the payload is summarized, it reveals activity patterns, risk levels, and timing information to an external service, which can leak sensitive operational behavior and create an unexpected data-sharing path.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Hardcoded credentials allow anyone with code access to reuse the Feishu application identity, and the script silently uses those credentials to obtain tokens and message a fixed recipient. In the context of an audit skill, undisclosed authenticated outbound communication is especially risky because it can leak operational metadata and undermines trust in the tool.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits integrity-alert contents, including filenames and change status, to an external Feishu API without a clear user-facing warning in the skill interface. Even if intended for security alerting, this sends potentially sensitive workspace metadata off-host and could reveal project structure or security events to an external service.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A hardcoded application secret is sent over the network during token acquisition without any disclosure to the operator and without secure secret handling. Even if TLS is used, the real issue is exposure of a reusable credential in code, which enables unauthorized API access if the repository, build artifacts, or host are compromised.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.