Feishu Send Media

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:06 AM UTC
• Version: 1.0.2

Overview

The skill does what it says broadly, but its automatic fallback behavior can move user files into Feishu Drive and loosen local file permissions without clear user approval.

Review this skill carefully before installing. Only use it when you are comfortable with files being sent to Feishu, and avoid letting it automatically upload to Drive or change file permissions without an explicit confirmation step and cleanup plan.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50

Finding

Predictable Workspace Staging Permits File Collisions and Symlink-Following Overwrites

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–53; the unsafe operation is repeated at lines 94–96 and mandated by lines 166–170
Vulnerability Type: Unsafe temporary-file handling and forced overwrite
Risk Level: Medium

Vulnerable Code:

bash

# Extract filename from source path
filename=$(basename "/source/path/to/file.png")

# Copy to workspace (overwrite if exists)
cp -f "/source/path/to/file.png" "~/.openclaw/workspace/${filename}"

The retry procedure repeats the operation:

bash

# Sometimes transient failure, retry
cp -f "/source/path/to/file.png" "~/.openclaw/workspace/${filename}"
# Resend

Technical Analysis

The destination filename is derived solely from the source basename and is therefore predictable. The command then uses cp -f, which intentionally replaces an existing destination. Two unrelated source files with the same basename consequently share the same staging location.

If another process or user can modify the workspace directory, an attacker may pre-create the expected destination as a symbolic link. Depending on the platform and cp implementation, the forced copy may follow that link and replace its target with attacker-selected source content. The retry workflow performs the same unsafe write again, increasing exposure rather than recovering safely.

The quoted destination also contains "~". Shell tilde expansion does not occur when the tilde is quoted, so the documented command refers to a literal path beginning with ~ rather than reliably resolving the current user's home directory. This can cause staging and validation to operate on an unintended location.

Attack Path

1. The attacker learns or predicts the basename of a file that the Agent will send.
2. The attacker creates a colliding file or symbolic link at the corresponding workspace destination.
3. A user asks the Agent to send the source file through Feishu.
4. The Age ...[truncated 965 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the workspace path explicitly, such as with $HOME/.openclaw/workspace, rather than quoting a literal tilde.
• Create a private, uniquely named temporary directory for every operation using a secure primitive such as mktemp -d.
• Set restrictive directory and file permissions, such as 0700 for the directory and 0600 for staged files.
• Generate an unpredictable staging filename instead of relying only on the source basename. Preserve the original name separately as display metadata.
• Refuse to copy onto an existing destination and verify that every path component and destination is not a symbolic link.
• Use exclusive file creation and platform-supported no-follow controls where available.
• Confirm with a canonical-path check that the final destination remains inside the intended workspace.
• Remove staged files after successful delivery and during failure cleanup.
• Do not repeat the unsafe copy during retries; retry transmission from an already validated immutable staging file.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:142

Finding

Permission-Recovery Guidance Makes Sensitive Media World-Readable

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 142–148
Vulnerability Type: Excessive file-permission grant
Risk Level: Medium

Vulnerable Code:

markdown

| Error | Cause | Solution |
|-------|-------|----------|
| File not found | Wrong path | Verify source path exists |
| Permission denied | File permission issue | `chmod 644` on file |
| Tool error | Feishu API issue | Retry → base64 → drive |
| Empty file | Zero-byte file | Check source before copying |
| File too large | >20MB | Use Feishu drive |

Technical Analysis

Mode 0644 gives the file owner read and write access while granting read access to the file's group and every other local account. Applying this mode to private images, documents, audio, or video violates least privilege and modifies the security properties of the original source merely to facilitate transmission.

A permission-denied error does not establish that globally readable permissions are necessary or appropriate. The error may indicate that the Agent is not authorized to access the file at all. Automatically broadening access bypasses that boundary rather than requiring explicit authorization or using a narrowly scoped transfer mechanism.

Attack Path

1. A sensitive media file is initially protected from other local users.
2. The user requests that the Agent send the file, but the operation encounters a permission error.
3. The Agent follows the documented checklist and applies chmod 644 to the source.
4. Every local account that can traverse the containing directories can read the file.
5. An unprivileged local attacker copies or inspects the media before its permissions are restored or the file is removed.

Exploitation requires another local account or process to have directory traversal access and the ability to read the newly exposed file.

Impact Assessment

The direct impact is unauthorized local disclosure of potentially sensit ...[truncated 314 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the blanket recommendation to use chmod 644.
• Treat a permission error as an authorization boundary and ask the user to provide an accessible copy or explicitly approve any permission change.
• Never change the original source file's permissions automatically.
• If the Agent already has legitimate read access, stage the file in a private directory and assign the staged copy mode 0600.
• Where access must be delegated, use narrowly scoped ACLs for the specific Agent identity instead of granting access to all local users.
• Record the original mode before any explicitly authorized change, restore it immediately afterward, and ensure restoration also occurs on errors.
• Validate directory permissions because restrictive parent directories are also required to protect staged media.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The fallback instructs the agent to automatically upload files to Feishu Drive and share the returned URL if direct sending fails. This is more dangerous than a retry because it silently changes the storage location and sharing model, potentially broadening access without explicit user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description is broad enough to match ordinary requests to 'send, share, or transfer media files,' which can cause the skill to activate in situations where the user did not specifically intend Feishu transmission. Over-broad invocation increases the risk of accidental exfiltration of local files or misdelivery to Feishu recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the agent how to send local files and base64 image data to Feishu but omit any requirement to warn the user that local content is leaving the system. Without an explicit notice and confirmation step, sensitive files or images could be transmitted externally with insufficient user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The workflow requires copying user files into a persistent workspace directory and overwriting existing files, which can leave sensitive content behind across sessions. That increases exposure to later unintended reuse, discovery by other actions, or confusion from stale/persistent data handling.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

# Extract filename from source path
filename=$(basename "/source/path/to/file.png")

# Copy to workspace (overwrite if exists)
cp -f "/source/path/to/file.png" "~/.openclaw/workspace/${filename}"

# Verify copy succeeded

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is scoped as sending media in Feishu chats, but the fallback expands behavior into uploading files to Feishu Drive and then sharing links. That changes the data destination, retention model, and access semantics, increasing the chance of unintended disclosure of local files beyond the user's expected chat-only action.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

| Error | Cause | Solution |
|-------|-------|----------|
| File not found | Wrong path | Verify source path exists |
| Permission denied | File permission issue | `chmod 644` on file |
| Tool error | Feishu API issue | Retry → base64 → drive |
| Empty file | Zero-byte file | Check source before copying |
| File too large | >20MB | Use Feishu drive |

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The mandatory rule mixes Chinese text ("临时路径") into otherwise English instructions, effectively imposing a language choice without explanation or user opt-in. The policy requires avoiding forced language or locale constraints unless they are optional or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.