Feishu Cache Guardian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned, but it deserves review because it can persistently modify an installed OpenClaw plugin and restart the Gateway automatically.

Install only if you intentionally want this skill to patch your local OpenClaw Feishu installation. Review the script first, run it manually before adding cron, be prepared for Gateway restarts, and avoid scheduled use unless the skill directory is protected and you have a recovery plan for the modified probe.ts file.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:38
• Finding: Persistent Scheduled and Boot-Time Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-51 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: Medium ### Vulnerable Code ```bash openclaw cron add \ --name "feishu-cache-check" \ --schedule "0 9 * * *" \ --command "node ~/.openclaw/workspace/skills/feishu-cache-guardian/scripts/check-and-fix.js" ``` ```bash openclaw cron add \ --name "feishu-cache-post-upgrade" \ --schedule "@reboot" \ --command "sleep 30 && node ~/.openclaw/workspace/skills/feishu-cache-guardian/scripts/check-and-fix.js" ``` ### Technical Analysis The documentation recommends registering both a recurring daily task and a boot-triggered task. These tasks survive the original Skill invocation and repeatedly execute code from a user-writable workspace path. The invoked script modifies source code in the global OpenClaw installation and restarts the OpenClaw Gateway. Consequently, the scheduled commands establish a persistent execution path with effects beyond the session in which the Skill was initially configured. Although the persistence mechanism is documented and serves the stated cache-maintenance purpose, executing a script from a mutable workspace path creates a security boundary concern. If that script or its containing directory is subsequently replaced or compromised, the already-registered task will execute the modified code automatically. ### Attack Path 1. A user follows the documented setup instructions and registers the daily or boot-time OpenClaw cron task. 2. The task remains registered after the current session and across system restarts. 3. An attacker or another compromised process modifies `~/.openclaw/workspace/skills/feishu-cache-guardian/scripts/check-and-fix.js`. 4. At the next scheduled time or system boot, OpenClaw executes the modified script automatically. 5. The substituted code runs with the permissions of the account or service responsible for the scheduled task. ### Impact Assessment The pers ...[truncated 513 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace recurring and boot-time execution with an explicit, one-time command run after a verified OpenClaw upgrade. 2. Prefer a supported OpenClaw configuration interface instead of repeatedly patching installed source code. 3. If scheduling is operationally required: - Execute an immutable or administrator-owned script rather than one in a user-writable workspace. - Verify the script's cryptographic hash or signature before every invocation. - Restrict write permissions on the script and its parent directories. - Run the task under a dedicated least-privileged service account. - Record every execution and modification in an audit log. 4. Document commands for inspecting and removing the registered tasks. 5. Require explicit user confirmation before installing any recurring or boot-time task. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-and-fix.js:16
• Finding: Unverified In-Place Modification of Installed OpenClaw Source<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check-and-fix.js`, lines 16-17 and 45-67 **Vulnerability Type**: Unsafe non-atomic modification of package-managed source **Risk Level**: Medium ### Vulnerable Code ```js const successMatch = content.match(/const PROBE_SUCCESS_TTL_MS = (\d+ \* \d+ \* \d+)/); const errorMatch = content.match(/const PROBE_ERROR_TTL_MS = (\d+ \* \d+ \* \d+)/); ``` ```js // 修复配置 let newContent = content .replace( /const PROBE_SUCCESS_TTL_MS = \d+ \* \d+ \* \d+;/, 'const PROBE_SUCCESS_TTL_MS = 60 * 60 * 1000; // 60 minutes' ) .replace( /const PROBE_ERROR_TTL_MS = \d+ \* \d+ \* \d+;/, 'const PROBE_ERROR_TTL_MS = 60 * 60 * 1000; // 60 minutes' ); // 写入文件 writeFileSync(PROBE_PATH, newContent, 'utf-8'); console.log('✅ 缓存配置已修复为60分钟'); // 重启 Gateway console.log('🔄 正在重启 OpenClaw Gateway...'); try { execSync('openclaw gateway restart', { stdio: 'inherit' }); ``` ### Technical Analysis The script directly overwrites a package-managed TypeScript source file without creating a backup, checking the installed OpenClaw version, verifying the original file hash, validating the transformed file, or using an atomic replacement operation. The detection expressions and replacement expressions also apply different syntax requirements. Detection does not require a trailing semicolon: ```js /const PROBE_SUCCESS_TTL_MS = (\d+ \* \d+ \* \d+)/ ``` Replacement does require one: ```js /const PROBE_SUCCESS_TTL_MS = \d+ \* \d+ \* \d+;/ ``` A changed upstream file can therefore pass the initial detection while failing one or both replacements. The script does not count replacements or verify that both resulting constants have the expected values. It can report that the repair succeeded and restart the Gateway even when the intended transformation was incomplete. `writeFileSync` writes directly to the destination. A process interruption, storage failure, or concurrent package update can leave the installed sourc ...[truncated 1704 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an officially supported OpenClaw or Feishu configuration mechanism instead of modifying installed source files. 2. Before editing, verify the exact supported OpenClaw version and the expected hash or canonical structure of `probe.ts`. 3. Require exactly one match and one successful replacement for each constant. Abort on zero, duplicate, or ambiguous matches. 4. Parse the TypeScript source with an appropriate parser rather than relying on formatting-sensitive regular expressions. 5. Write the modified content to a temporary file in the same directory, flush it, validate its syntax and expected values, and atomically rename it over the destination. 6. Preserve file permissions and ownership during replacement. 7. Create a timestamped backup before modification and automatically restore it if validation or Gateway restart fails. 8. Re-read the resulting file and confirm that both TTL constants equal the expected values before reporting success. 9. Coordinate with package updates using an appropriate lock to prevent concurrent writes. 10. Restart the Gateway only after all checks pass, and provide a dry-run mode that displays the proposed change without writing it. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Importing and using execSync to restart a service gives the script a broader operational capability than its stated purpose of checking and fixing cache configuration. Even though the command string is static and not obviously injectable here, this still increases the blast radius of running the skill and can enable unintended service interruption when users expect only file inspection or modification.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script performs an operationally significant side effect—restarting the OpenClaw Gateway—while presenting itself primarily as a cache-checking and repair tool. Hidden or underdocumented service restarts can cause unexpected downtime, disrupt active workloads, and make reviewers underestimate the privileges and impact of executing the skill.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The package description is written entirely in Chinese, which imposes a specific language choice in user-facing metadata without indicating any opt-in, alternative locale, or region-specific justification. This can violate language/locale policy when skills are expected to be accessible without forcing one language by default.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The header comment describes only checking and repairing probe.ts cache configuration, omitting that the script also restarts the Gateway. This kind of mismatch is dangerous because operators and code reviewers may approve or run the tool without realizing it can affect service availability, especially in automation contexts.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-and-fix.js:64