Feishu File Send

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Feishu file-sending purpose, but it recommends a persistent broad /tmp upload allowlist that could expose unintended local files.

Review before installing. The Feishu attachment workflow is useful, but do not whitelist the entire /tmp directory; use a dedicated outbound directory with restrictive permissions and require explicit user approval before changing gateway config or sending local files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:137

Finding

Overly Broad Temporary-Directory Allowlisting Recommendation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:137-139; references/feishu-file-sending-notes.md:57-60
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Snippets:

SKILL.md:137-139

markdown

If dynamic files are commonly generated under `/tmp/`, consider adding `/tmp` to Feishu `mediaLocalRoots` in `~/.openclaw/openclaw.json` and restart gateway.

如果经常生成临时文件，可在配置中将 `/tmp` 加入飞书渠道的 `mediaLocalRoots` 白名单，然后重启 gateway。

references/feishu-file-sending-notes.md:57-60

markdown

## Suggested config direction

If dynamic files are commonly generated under `/tmp/openclaw/`, consider adding `/tmp/openclaw` or `/tmp` to Feishu `mediaLocalRoots` and restart the gateway.

Technical Analysis

The documentation recommends adding the shared /tmp directory to mediaLocalRoots. This broadens the set of local files that the Feishu attachment mechanism is permitted to access and conflicts with the principle of least privilege.

A shared temporary directory can contain files created by unrelated users or processes. Depending on the gateway's path-validation implementation, it may also contain attacker-controlled symbolic links or other filesystem objects that resolve to files outside the intended outbound-file workspace. Treating every path beneath /tmp as eligible media therefore creates a path-confusion and unintended-file-disclosure risk.

The project does not itself implement automatic file collection, credential access, or exfiltration. Exploitation requires the gateway configuration to adopt this recommendation and a subsequent attachment operation to reference attacker-influenced content.

Attack Path

1. An administrator follows the documented recommendation and adds /tmp to Feishu mediaLocalRoots.
2. A local attacker or another process creates a file in /tmp, or places a symbolic link there that targets a file readable by the gateway proce ...[truncated 1062 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to add the entire /tmp directory to mediaLocalRoots.
2. Create a dedicated outbound directory, such as ~/.openclaw/workspace/outbound, owned by the gateway account and inaccessible to unrelated users.
3. Configure mediaLocalRoots with only that dedicated directory.
4. Copy generated attachments into the dedicated directory using securely generated, non-predictable filenames.
5. Before transmission, resolve the canonical path and verify that it remains beneath the approved root.
6. Reject symbolic links and non-regular files, and verify expected ownership and restrictive permissions.
7. Where temporary storage is unavoidable, use a private per-process or per-user directory with mode 0700 rather than shared /tmp.
8. Delete staged outbound files after delivery according to an explicit retention policy.
9. Update both affected documentation files so that troubleshooting guidance consistently preserves least-privilege filesystem access.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.