T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:59- Finding
Unauthenticated Chat Messages Can Impersonate Persistent System Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
feishu-group-memory-system-飞书群聊记忆管理
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent group-memory purpose, but it asks the user to install persistent rules that let ordinary chat messages prefixed with [SYSTEM] trigger open-ended agent actions.
Review before installing. The main risk is not hidden malware; it is overbroad persistent agent behavior. Do not install the [SYSTEM] message handling rule as written, and avoid automatic save/load or diary copying unless every group participant understands that summaries may be retained and later resurfaced. Prefer explicit save/load commands, per-group opt-in, and isolated per-group memory files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The core feature is persistent storage of group conversation summaries, but the documentation provides no explicit user-facing notice, consent flow, retention policy, or privacy warning. Persisting conversational content automatically without disclosure is a significant privacy and compliance risk, especially in multi-party group chats.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates writing actual group discussion highlights into the user's diary without providing a strong warning about privacy impact or data mixing. This broadens access paths and retention surface for potentially sensitive group information, raising confidentiality and compliance concerns.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is described as group-chat context persistence, but in private chat it instructs the agent to record the conversation into a diary instead. That expands data collection beyond the stated purpose and can capture private-chat content under a different storage channel without clear consent or scope limitation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The load trigger phrases include common conversational expressions such as asking where the conversation left off. In normal chat this can cause unintended memory retrieval, which may inject stale or sensitive content into the conversation without the user clearly intending to access persisted group memory.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The auto-save condition depends on undefined concepts like 'important conversation' and 'unsaved' state. Ambiguous criteria make over-collection likely, causing the agent to persist more group content than users expect and making enforcement of least-privilege retention difficult.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill promotes automatic saving and loading of group conversations, including vaguely defined 'important' unsaved chats. This encourages continuous persistence of user data and increases the amount of conversational material available for later retrieval, misuse, or accidental disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Automatic loading of group memory at session start changes model behavior using prior persisted chat content, but users are not told this will happen. This can unexpectedly expose old group information in a new session and undermines user expectations about ephemeral conversations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
1. 创建存储目录
bash mkdir -p ~/.openclaw/workspace/memory/FeishuGroupMemory2. 配置 AGENTS.md
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill not only stores group memory in a dedicated file, but also requires writing summarized group-chat content into the user's general daily diary. This creates cross-context data propagation, increasing the chance that sensitive group information is later surfaced in unrelated contexts or retained more broadly than intended.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Recording real group-conversation content into a daily diary creates semantic data leakage across contexts: information from one group can later appear in unrelated prompts, summaries, or recalls tied to the diary. The risk is not just storage, but downstream resurfacing of sensitive natural-language content outside its original audience and purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown content presents all instructions and labels exclusively in Chinese, with no indication that the skill supports other languages or that Chinese is an explicitly documented, region-specific requirement. Under the policy rule for language/locale, this can be interpreted as forcing a specific language without user opt-in.
- Content