Custom Gift Leewow

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.24

Overview

This gift-customization skill is mostly coherent, but it needs review because it can send Feishu messages with app credentials, continue sending in a background process, upload user images, and generate broad COS access links.

Install only if you trust this publisher with a Leewow secret key, Feishu app credentials, and user-provided images. Use a least-privilege Feishu app and target chat, avoid sensitive personal photos, keep LEEWOW_API_BASE on the official Leewow domain, and review whether you want the generic COS presign tool and deferred Feishu sending enabled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tainted flow: 'url' from os.getenv (line 25, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

return _sts_cache

    url = LEEWOW_API_BASE + STS_ENDPOINT
    resp = requests.get(url, timeout=15)
    resp.raise_for_status()
    data = resp.json()
    if not data.get("tmpSecretId"):

• Confidence: 89% confidence
• Finding: The STS credential endpoint is derived from an environment variable and then queried directly, which allows a deployment-time attacker or misconfiguration to redirect the request to an arbitrary host. Because the response supplies temporary COS credentials, a malicious endpoint could feed attacker-controlled credentials or capture request metadata, enabling SSRF-style abuse, exfiltration, or upload redirection to attacker-controlled storage.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script automatically loads all variables from ~/.openclaw/.env before performing a simple browse function, causing the tool to ingest potentially unrelated secrets from a broad local secrets file. That expands the skill's trust boundary unnecessarily and can expose sensitive credentials to later code paths, child processes, logs, or third-party libraries if the process is compromised or misused.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The tool silently spawns a detached background subprocess to continue sending messages after the main action returns. In an agent-skill context, deferred autonomous network activity is risky because it reduces user visibility and control, and can continue operating with credentials after the initiating request has completed.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This script creates presigned URLs that grant temporary access to objects in private COS buckets, and it accepts arbitrary COS URLs without checking that the object belongs to an approved bucket, prefix, or workflow. In the context of a gift-browsing/mockup skill, this is broader-than-necessary access-enablement functionality that could expose private images or other stored assets if the tool is invoked on attacker-chosen URLs.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The batch signing helper turns the module into a generic private-object access service rather than a narrowly scoped helper for a documented product feature. That capability expansion increases abuse potential because a caller can mass-generate temporary access links for multiple private objects, amplifying data exposure if the surrounding system lacks strict authorization.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a custom-gift browsing and mockup workflow, but it exposes a generic COS presigned-URL utility that is not tightly scoped to that purpose. This expands the skill's capability surface and can be abused to mint temporary access links for arbitrary COS objects if the backend credentials permit it, creating a data access primitive unrelated to the user-facing task.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger guidance includes broad, everyday phrases such as gift-related browsing and customization requests, increasing the chance the skill is invoked in contexts where the user did not intend external tool execution or direct Feishu sending. In this skill, over-invocation is more dangerous than usual because invocation can cause network activity, file handling, and outbound messaging to Feishu with a `NO_REPLY` pattern that reduces user-visible confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code places Feishu app credentials into the child process environment for deferred sending, which broadens credential exposure beyond the original process without clear disclosure. Environment variables are commonly inherited, inspectable by same-user processes in some environments, and may be captured in debugging, crash, or process-inspection workflows.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script uploads a user-supplied local image to a remote COS bucket and then submits its URL to an external generation API, but it provides no explicit disclosure, consent prompt, or data-handling warning at the point of transfer. In this skill context, users may provide personal photos for gift customization, so silent transmission of potentially sensitive images to third-party services creates a real privacy and compliance risk even though the upload is functionally required.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.