ClawHub
Back to skill

Security audit

FeishuBitable-Plus

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Feishu Bitable CLI, but it stores secrets weakly and can change or delete live business data through broad natural-language commands with limited safeguards.

Install only if you are comfortable granting this tool Feishu Bitable app, table, and record permissions. Prefer a least-privilege Feishu app, avoid passing secrets on the command line, rotate any secret previously entered that way, and test natural-language write/delete/sync commands only on non-production tables until confirmations and safer credential storage are added.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
README.md:16
Finding

Mutable External Package Executed During Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:27
Finding

Feishu Application Secret Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (47)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · dist/core/api-client.js (reported line 61)May include surrounding context.

js
});
            const { code, msg, tenant_access_token, expire } = response.data;
            if (code !== 0) {
                throw new Error(`Failed to get access token: ${msg}`);
            }
            this.tenantAccessToken = tenant_access_token;
            // 提前5分钟过期

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code claims to provide secure or encrypted credential storage, but it only Base64-encodes the app ID and secret before writing them to disk. Base64 is trivially reversible and offers no confidentiality, so any local user, malware, backup system, or process with file access can recover the credentials immediately.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

This component explicitly handles credential storage and retrieval from a predictable file in the user's home directory. In the context of this skill, that makes the insecure-at-rest handling more dangerous because it centralizes long-lived secrets in a discoverable location, increasing the blast radius of local compromise, malware, accidental disclosure, or backup leakage.

Content

Scanner excerpt · dist/security/config-manager.js (reported line 49)May include surrounding context.

js
credentialsFile;
    constructor() {
        this.configDir = path.join(os.homedir(), '.feishu-bitable-plus');
        this.credentialsFile = path.join(this.configDir, 'credentials.json');
        this.ensureConfigDir();
    }
    ensureConfigDir() {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file lists '创建/读取/更新/删除' as a core capability, which includes deletion of user data. Under the markdown-specific warning criterion, user-facing documentation should disclose potentially destructive behavior that can affect user data, but this entry provides no caution or confirmation note.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The command list explicitly advertises a delete operation, but the surrounding markdown does not warn users that invoking it may irreversibly remove records. For markdown skill documentation, destructive behaviors that affect user data should be clearly disclosed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The quickstart instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version without pinning. If the upstream package is compromised or a breaking/malicious release is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The setup instructions tell users to enter an App ID and App Secret but provide no guidance on secure handling of those credentials. This can lead to secrets being stored insecurely, pasted into logs or shared terminals, or committed into shell history and configuration files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide presents create, update, delete, import, and export commands as routine examples without any warning that they modify or remove live data. In an agent or CLI context, this increases the chance of accidental destructive operations, especially for users testing commands against production tables.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub@latest install feishu-bitable-plus, which fetches and executes the latest package version at install time without pinning a known-good release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute unreviewed code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README documents destructive and bulk-modifying commands such as create, update, delete, import, and export without warning about irreversible data changes, scope, or the need to validate targets first. In a natural-language and bulk-operation context, this increases the chance of accidental mass modification or deletion of enterprise records.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is described as accepting broad natural-language commands to operate Feishu Bitable, but it does not define boundaries, confirmation requirements, or excluded actions. In a skill with CRUD, sync, and batch capabilities, ambiguous natural-language scope can cause unintended sensitive reads or destructive modifications from loosely phrased prompts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx clawhub@latest, which pulls and executes whatever package version is current at install time. This creates a supply-chain risk because users cannot reproduce or review the exact code being run, and a compromised or malicious future release could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises full CRUD, bulk import/export, and cross-table synchronization without warning that these actions can modify or delete business data at scale. In the context of an enterprise data-management skill, missing warnings and safeguards increase the chance of accidental mass updates, deletions, or data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The interactive mode accepts free-form natural-language commands and immediately passes them to executeNaturalLanguage without any explicit warning that the command may create, update, or delete remote table data. In a CLI that operates on live Feishu Bitable resources, this increases the risk of users unintentionally issuing destructive actions under the assumption that the mode is read-only or merely advisory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file declares a deleteRecord operation, which is a destructive action affecting user data. In the visible declaration and comments, there is no confirmation prompt, user-facing warning, or explanatory notice indicating that records may be permanently removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends the configured app_id and app_secret to a remote Feishu authentication endpoint, which is a sensitive credential transmission. While the file has technical comments, it does not include any user-facing disclosure, warning, or confirmation around handling and transmitting these credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The deleteRecord method issues a remote DELETE request that removes records, which is a destructive operation. The function includes no confirmation prompt, user-facing log, or warning comment indicating that data will be deleted.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The intent recognition patterns throughout the file are written exclusively for Chinese trigger phrases, so users must phrase requests in Chinese for the skill to work. This is a natural-language policy concern because the file does not provide user opt-in, language selection, or a documented justification for restricting operation to a specific locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This code accepts and writes appId and appSecret to disk, which is safety-relevant handling of credentials. Although comments describe the implementation for developers, there is no user-facing prompt, warning, or disclosure in this file that secrets will be stored locally in a file under the user's home directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The method deletes the stored credentials file via fs.unlinkSync, which is a destructive operation affecting user data. While there is a brief code comment naming the action, there is no user-facing confirmation, log, or disclosure in this file that the credentials will be removed when this method is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill executes record deletion immediately once intent parsing identifies DELETE_RECORD and required parameters are present, with no confirmation, dry-run, or safeguard against misclassification. In a natural-language skill, parsing errors or ambiguous commands can cause irreversible data loss, making destructive actions riskier than in a strictly typed API.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The method documentation at L234-L238 presents batch record creation as an available skill capability via batchCreateRecords. However, the main natural-language dispatcher explicitly returns NOT_IMPLEMENTED for BATCH_CREATE at L128-L139, directing users elsewhere instead of performing the action. This is a direct contradiction between exposed code documentation and actual behavior in the skill's command execution path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The sync operation bulk-copies all records from one table to another without user-facing confirmation, preview, deduplication, or scope limits. In this skill context, a mistaken table-name match or ambiguous natural-language request could trigger large-scale unintended writes, causing data corruption, duplication, or contamination across business tables.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The credential setup instructions show passing the Feishu app secret directly on the command line, but do not warn that command-line secrets may be exposed through shell history, process listings, logs, or screenshots. This is especially relevant for enterprise API credentials that may grant broad table access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The createRecord and updateRecord methods perform file-scope data modification against a remote Feishu Bitable service. The declarations include brief labels but no user-facing warning, confirmation, or explicit documentation that the skill writes user data to an external system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.