data-analysis-for-feishu

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a chart generator, but it quietly loads chart code from an external CDN inside a browser launched without sandboxing while describing the renderer as local.

Review before installing in sensitive environments. Use only with data you are comfortable exposing to a remote chart-library CDN unless the ECharts asset is vendored locally, run it in an isolated environment, pin and verify dependencies/browser downloads, and avoid granting broader file or network access than needed for the selected input and output paths.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/generate_echarts_screenshot.py:13

Finding

Unverified Remote JavaScript Execution in a Chromium Browser with Sandbox Disabled

Content

View full analysis

body {{ margin: 0; padding: 0; background: #fff; }} #chart {{ width: {width}px; height: {height}px; }}

""" ``` ### Technical Analysis Each screenshot operation instructs Chromium to retrieve and execute `echarts.min.js` from jsDelivr at runtime. Although the URL identifies ECharts version 5.4.3, the implementation does not verify the downloaded content through a cryptographic hash, signature, Subresource Integrity attribute, or trusted local copy. The payload that executes can ...[truncated 2669 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:2

Finding

Unpinned Python Dependencies and Unverified Executable Installation Chain

Content

View full analysis

=2.0.0 openpyxl>=3.1.0 # Used to read Excel files requests>=2.28.0 pyppeteer>=2.0.0 # Headless browser screenshot dependency ``` `README.md` and `SKILL.md`, lines 74-89: ```bash wget https://github.com/openclaw/skills/releases/download/data-analysis-for-feishu-v1.0.0/data-analysis-for-feishu.skill ``` ```bash cd /path/to/openclaw/skills git clone https://github.com/openclaw/data-analysis-for-feishu.git cd data-analysis-for-feishu pip install -r requirements.txt ``` `README.md` and `SKILL.md`, line 229: ```text A: First run automatically downloads Chromium browser (about 180MB), please wait patiently. Subsequent runs will be very fast. ``` ### Technical Analysis All Python dependencies use lower-bound constraints rather than exact versions. A command such as `pip install -r requirements.txt` may therefore install future releases that were not included in this audit. The requirements file also contains no package hashes, lock file, or authenticated dependency manifest. Pyppeteer adds a second executable-content retrieval stage: its browser-launch workflow can download a Chromium binary on first use. The documentation discloses that this download occurs, but the project does not independently pin or verify the expected browser artifact in its own configuration. The documented `.skill` download also has no accompanying checksum or signature-verification procedure. HTTPS reduces ordinary network interception risk but does not protect against compromise of the hosting account, release artifact, package registry, dependency maintainer, or build pipeline. The `requests` package is declared but no use of it was found in the audited so ...[truncated 1887 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Static analysis suggests the code acts more like a test harness that runs subprocesses and writes local artifacts than the advertised visualization skill. A skill that presents itself as a harmless charting utility but actually executes shell commands is more dangerous because users and platforms may underestimate the operational risk and approve it without proper sandboxing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Static analysis suggests the code acts more like a test harness that runs subprocesses and writes local artifacts than the advertised visualization skill. A skill that presents itself as a harmless charting utility but actually executes shell commands is more dangerous because users and platforms may underestimate the operational risk and approve it without proper sandboxing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Static analysis suggests the code acts more like a test harness that runs subprocesses and writes local artifacts than the advertised visualization skill. A skill that presents itself as a harmless charting utility but actually executes shell commands is more dangerous because users and platforms may underestimate the operational risk and approve it without proper sandboxing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Static analysis suggests the code acts more like a test harness that runs subprocesses and writes local artifacts than the advertised visualization skill. A skill that presents itself as a harmless charting utility but actually executes shell commands is more dangerous because users and platforms may underestimate the operational risk and approve it without proper sandboxing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The inline documentation is materially false: the script states there are no third-party API dependencies while the implementation loads executable JavaScript from jsDelivr. Misrepresenting network behavior is security-relevant because users may run the skill in restricted or sensitive environments under the false assumption that no outbound requests occur.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code explicitly claims 'fully local operation' and 'no third-party API dependencies' but imports ECharts at runtime from a public CDN. In a headless browser context, this creates an undeclared network dependency, leaks execution metadata/IP to a third party, and allows rendering behavior to be influenced by external availability or CDN compromise.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This is a true tool-parameter abuse pattern because the code delegates execution to a shell, allowing shell metacharacter interpretation and expansion. In an agent/skill ecosystem, even a 'test' helper can become dangerous if copied into automation, parameterized later, or invoked in environments where parts of the command, PATH, or working directory are attacker-controlled, potentially leading to arbitrary command execution.

Content

Scanner excerpt · test.py (reported line 15)May include surrounding context.

python

print(f"\n🔍 Testing: {description}")
    print(f"Command: {cmd}")
    try:
        result = subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True)
        print("✅ Success!")
        if result.stdout:
            print(f"Output: {result.stdout.strip()}")

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 17)May include surrounding context.

md

- MIT License, open source free for commercial use

### 🚀 What's Next
- Feishu workflow integration (auto send to groups/documents, scheduled reports)
- Custom theme support
- More chart types: heatmap, tree chart, sankey diagram
- Advanced analysis: trend prediction, anomaly detection

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that dependencies are automatically installed on first use and that the first run downloads a Chromium browser. Silent or under-disclosed network activity and system modification increase supply-chain and transparency risks, especially in agent environments where users may not expect code execution to fetch and install external components.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation advertises behavior that implies shell execution, network access, and file output, but it does not declare any tool scope such as permissions or allowed-tools. In an agent ecosystem, undeclared capabilities reduce transparency and can cause the host or user to authorize a skill without understanding that it may execute commands, download components, or write local artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level docstring describes the tool entirely in Chinese as a general-purpose parser, with no indication that the language choice is optional or tied to a region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language claim of 'fully local operation' is contradicted by the actual implementation, making this a deceptive security property rather than a mere wording issue. In the context of a data visualization skill for enterprise chat ecosystems, such misrepresentation can cause operators to expose internal usage metadata or break compliance assumptions about offline/local-only processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Fetching charting code from a CDN without disclosure introduces a silent supply-chain and privacy risk. Even if the version is pinned, the script still performs an unannounced outbound request during rendering, which is especially problematic for a tool marketed as local and likely to process potentially sensitive business data for Feishu/Lark users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The script executes commands through the system shell using subprocess.run(..., shell=True), which is unsafe if the command string can ever be influenced by external input, environment changes, or later code modifications. Although this test script currently builds commands from hardcoded strings, using a shell here creates unnecessary command-injection risk and normalizes an insecure pattern in a skill context where scripts may be adapted or reused.

Content

Scanner excerpt · test.py (reported line 15)May include surrounding context.

python

print(f"\n🔍 Testing: {description}")
    print(f"Command: {cmd}")
    try:
        result = subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True)
        print("✅ Success!")
        if result.stdout:
            print(f"Output: {result.stdout.strip()}")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The feature list says the skill works out of the box and that dependencies are automatically installed on first run, but it does not clearly warn users there that a browser download will occur. The later FAQ discloses Chromium download behavior, yet the main installation/usage sections do not prominently warn about this system-modifying network activity before first execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

该 markdown 文件的全部自然语言内容均为中文，用作技能参考文档时会对非中文用户形成默认语言约束，但文档中没有提供语言选择、双语说明或明确的适用范围。根据规则，未经过用户选择而强制单一语言属于自然语言层面的组织政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The dependency file contains a natural-language comment in Chinese ("飞书ECharts数据分析技能依赖包"), which signals a fixed language choice in user-facing project text without any indication of user opt-in or locale justification. Under the policy rule, forcing a specific language without choice can be a locale-policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using a lower-bounded but unpinned dependency such as pandas>=2.0.0 makes builds non-reproducible and can silently pull in future releases with breaking changes or newly introduced vulnerabilities. In a data-processing skill that ingests external files, dependency drift increases supply-chain risk and complicates patch verification.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

# 飞书ECharts数据分析技能依赖包
pandas>=2.0.0
openpyxl>=3.1.0 # 用于读取Excel文件
requests>=2.28.0
pyppeteer>=2.0.0 # 无头浏览器截图依赖

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

An unpinned requests dependency is more security-relevant because this library handles outbound HTTP and has a history of security advisories. Allowing any future version above 2.28.0 can introduce unreviewed behavior or leave deployments on unresolved vulnerable versions depending on installer resolution, which is especially risky in a Feishu-integrated skill likely to fetch remote resources or APIs.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# 飞书ECharts数据分析技能依赖包
pandas>=2.0.0
openpyxl>=3.1.0 # 用于读取Excel文件
requests>=2.28.0
pyppeteer>=2.0.0 # 无头浏览器截图依赖

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest emphasizes chart generation and visualization for Feishu, but this script also supports writing output to a caller-specified filesystem path. While related to producing chart artifacts, local file modification goes beyond a purely in-memory/stdout visualization description and is not explicitly stated in the manifest.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/main.py (reported line 136)May include surrounding context.

python

args.type = analysis_result["recommended_chart"]
                if "recommended_fields" in analysis_result:
                    for field, value in analysis_result["recommended_fields"].items():
                        if not getattr(args, field, None):
                            setattr(args, field, value)
            
            # Auto generate title if not provided

Static analysis

No suspicious patterns detected.