feishu-doc-editor

• Analyzed: May 12, 2026, 4:05 AM
• Findings: 1
• Version: 1.0.0
• Hash: c28aff06589c954f4d9ff37a1b2aa70f77ac4d8f83be0029abbc9fde2b3bc929
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides extensive instructions and `bash` examples for interacting with the Feishu OpenAPI, including obtaining access tokens, reading, writing, updating, and deleting document content. While the stated purpose is legitimate, the numerous `curl` and shell script examples (e.g., in `references/api-guide.md`, `references/common-errors.md`) introduce a significant risk of shell injection if the OpenClaw agent does not rigorously sanitize user-provided inputs before executing these commands. Additionally, the `log_error` function in `references/common-errors.md` performs file write operations to `/tmp/feishu_api_errors.log`, which, while intended for debugging, represents a capability that could be misused if parameters were controllable. These capabilities, though plausibly needed for the skill's function, elevate the classification to suspicious due to the potential for exploitation in an AI agent execution environment.