Feishu Attachment Send

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:25 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Feishu file-sending helper, but one reference recommends allowing all of /tmp as an attachment source, which could expose unintended local files.

Review this before installing if your Feishu gateway can send local files. Prefer a dedicated, access-controlled staging directory under the OpenClaw workspace, and do not add the system-wide /tmp directory to mediaLocalRoots unless you fully understand and accept the disclosure risk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/feishu-file-sending-notes.md:57
• Finding: Overly Broad Temporary Directory Media Allowlist Recommendation## Vulnerability Details **File Location**: `references/feishu-file-sending-notes.md`, lines 57–60 **Vulnerability Type**: Unsafe local file access configuration **Risk Level**: Medium **Complete Snippet**: ```markdown ## Suggested config direction If dynamic files are commonly generated under `/tmp/openclaw/`, consider adding `/tmp/openclaw` or `/tmp` to Feishu `mediaLocalRoots` and restart the gateway. ``` ### Technical Analysis The documentation recommends adding either `/tmp/openclaw/` or the entire system-wide `/tmp` directory to Feishu's `mediaLocalRoots`. Allowlisting `/tmp` violates least-privilege principles because it makes a shared temporary directory eligible as a source for outbound attachments. On multi-process or multi-user systems, `/tmp` may contain files created by unrelated applications or users. Broadly authorizing this directory increases the chance that an unintended, attacker-controlled, or sensitive temporary file can be transmitted through Feishu. The risk may also be increased by symlinks or path-resolution weaknesses if the gateway does not canonicalize paths and reject symbolic-link traversal. This recommendation is unnecessary because `SKILL.md`, lines 43–46, already describes a safer procedure: copy only the intended file into a dedicated allowed workspace before sending it. ### Attack Path 1. An administrator follows the documented recommendation and adds `/tmp` to `mediaLocalRoots`. 2. An unrelated application, local attacker, or compromised process creates or identifies a sensitive or misleading file under `/tmp`. 3. The Agent receives a malicious, ambiguous, or mistaken instruction to send that path as a Feishu attachment. 4. Because `/tmp` is allowlisted, the gateway accepts the file as an authorized media source. 5. The file is transmitted to a Feishu user or group, resulting in unauthorized disclosure. Exploitability depends on the gateway's path canonicalization, symlink handl ...[truncated 560 chars]
• Remediation: ## Remediation Suggestions 1. Remove the recommendation to add the system-wide `/tmp` directory to `mediaLocalRoots`. 2. Create a dedicated media staging directory, such as `~/.openclaw/workspace/outbound-media/`, accessible only to the gateway account. 3. Copy only the explicitly requested file into that directory before transmission. 4. Resolve and validate the canonical path before sending, and ensure it remains beneath the approved staging root. 5. Reject symbolic links and paths containing traversal components. 6. Apply restrictive directory and file permissions. 7. Generate unpredictable staged filenames to prevent collisions and substitution. 8. Delete staged files after successful delivery or after a short retention period. 9. If a temporary directory is operationally required, use a private per-service directory with restrictive permissions rather than the shared `/tmp` root.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description repeatedly says to 'strongly prefer' or 'usually' select this skill for broad categories of Feishu interactions involving files or attachment troubleshooting. That can cause over-invocation in routine conversations, leading the agent to apply this workflow when it is unnecessary or when a narrower, safer skill should be chosen instead. In this context the behavior is operational rather than overtly malicious, but broad routing logic can still degrade control and increase the chance of unintended actions.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger section lists many activation scenarios but provides almost no limiting conditions or exclusion criteria. This ambiguity can cause the agent to select the skill in loosely related Feishu conversations, increasing the likelihood of unnecessary file-handling behavior and mistaken workflow execution. The surrounding skill context makes this somewhat more concerning because the skill is framed as the default for outbound files and troubleshooting across DMs and groups.

Static analysis

No suspicious patterns detected.