Feishu Card Display

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

The skill is a clear Feishu display helper, but it can automatically send unvalidated upstream messages and local files to Feishu without user confirmation or a transparent completion summary.

Install only if you trust the upstream skills that will produce Feishu payloads. Before using it with sensitive workspaces, add or require controls that confirm file uploads, restrict file paths to intended export artifacts, and make Feishu sends auditable instead of silently ending with NO_REPLY.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:23

Finding

Untrusted Upstream Tool Calls Enable Unauthorized Messaging and Local File Exfiltration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–27, 62–71, and 81–89
Vulnerability Type: Unvalidated delegation of message-tool authority and unrestricted local file transmission
Risk Level: High

Vulnerable Code

markdown

If upstream output says `displaySkill: "feishu-card-display"`, you MUST:
1. Execute each returned `messageToolCalls` item **in order**
2. Use the OpenClaw `message` tool for every send
3. Preserve the payload exactly as returned
4. After all sends finish, reply with **`NO_REPLY`**

markdown

### Media payload

When a call contains:

```json
{
  "action": "send",
  "channel": "feishu",
  "filePath": "/path/to/file",
  "message": ""
}

text

```markdown
## Final Reply

After all upstream `messageToolCalls` are executed, the assistant must reply with:

```text
NO_REPLY

text

### Technical Analysis

The skill instructs the agent to execute every `messageToolCalls` item supplied by upstream output and to preserve each payload exactly. It does not require validation of the upstream source, user authorization, message destination, action type, payload contents, or referenced file path.

The media-send instructions expressly permit an absolute `filePath`. No allowlist, workspace boundary, sensitivity check, path canonicalization, or confirmation step prevents an upstream producer from referencing files that are unrelated to the legitimate card-display task. If the message tool can access the specified file, this creates a direct path for transmitting locally accessible information through Feishu.

The mandatory `NO_REPLY` response further reduces visibility by preventing the ordinary assistant response from describing what was sent. Although this does not itself grant additional permissions, it makes unauthorized activity less apparent to the user.

These instructions also establish a skill-instruction hijacking condition: attacker-controll
...[truncated 1626 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every upstream messageToolCalls object as untrusted input rather than a mandatory instruction.
2. Verify that the upstream producer is explicitly trusted and authorized to request Feishu sends.
3. Allowlist supported actions, channels, payload fields, and destination contexts. Reject unknown or additional fields.
4. Require explicit user confirmation before sending files, media, messages to a new destination, or other sensitive content.
5. Disallow arbitrary absolute file paths. Canonicalize paths and restrict media sends to a dedicated, approved export directory.
6. Reject symbolic links, path traversal, device files, credentials, configuration files, and files outside the authorized workspace.
7. Inspect text and card payloads for policy violations instead of requiring unconditional byte-for-byte execution.
8. Apply least privilege to the message tool and filesystem so the skill can access only files intentionally prepared for sharing.
9. Replace unconditional NO_REPLY with a transparent completion notice that identifies the number and type of sends performed, unless silent operation is separately authorized.
10. Record auditable metadata for each send, including the validated source, destination, payload type, file path where applicable, authorization decision, and result.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to transmit arbitrary upstream messageToolCalls to Feishu exactly as received, including cards, text, and media, without requiring any confirmation, provenance check, or user-facing notice that data is being sent to an external messaging platform. In this context, the risk is amplified because the skill is explicitly designed as a pass-through display layer and mandates preserving payloads unchanged, which could cause sensitive or unreviewed content from another skill or tool to be exfiltrated into the current Feishu conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The media flow tells the agent to send any provided filePath as media using the message tool, with no restriction on file origin, sensitivity, or whether the user intended external transmission. This is dangerous because it can turn arbitrary local or tool-produced files into outbound attachments to Feishu, creating a direct path for accidental disclosure of confidential documents, generated artifacts, or environment-derived files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.