Skill Trust Decision
fork-latte-skill
Hardcoded API key embedded in skill files and undeclared shell auto-heal capability with developer-specific hardcoded paths represent significant hidden behavior not reflected in the declared toolset.
Most direct threat evidence
High Credential Theft
Hardcoded API key embedded in skill files API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in relay-server/config.json (also committed to repo), config.example.json, and SKILL.md as built-in defaults. If relay is exposed beyond localhost, anyone with this key can POST registration data to the target Feishu bitable.
relay-server/config.json:1 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
10 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
2 dependency or supply-chain issues need attention.
What drove the risk score up
Undeclared shell execution +15
SKILL.md declares bins:["curl"] but uses Start-Process/Invoke-RestMethod PowerShell commands with shell:WRITE semantics
Hardcoded API key exposure +15
API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in both config.json and SKILL.md defaults; not user-scoped
Developer-specific hardcoded paths +10
Auto-heal logic contains absolute paths to C:\Users\聿\... specific to one developer's machine
No declared permissions for shell access +5
Skill metadata only declares curl bin; no allowed-tools mapping for shell resource
Most important evidence
High Credential Theft
Hardcoded API key embedded in skill files
API key 'jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68' is hardcoded in relay-server/config.json (also committed to repo), config.example.json, and SKILL.md as built-in defaults. If relay is exposed beyond localhost, anyone with this key can POST registration data to the target Feishu bitable.
relay-server/config.json:1 Remove api_key from default configs; require users to set their own. If publishing, do not include any active credentials.
High Priv Escalation
Undeclared shell auto-heal with developer-specific hardcoded paths
Step 0.5 of SKILL.md implements auto-heal that silently starts the relay-server via PowerShell Start-Process. The code iterates hardcoded paths including 'C:\Users\聿\.qclaw\skills\fork-latte-skill\relay-server' — a path specific to the developer's Chinese-username Windows machine. This is undeclared, uses shell:WRITE level execution, and the developer-specific path makes it non-functional for other users while revealing internal structure.
SKILL.md:27 Declare shell:WRITE in allowed-tools. Replace hardcoded developer paths with dynamic discovery (e.g., search skill directories or prompt user). Document the auto-heal behavior explicitly.
Medium Doc Mismatch
Declared bins do not match actual tool dependencies
SKILL.md metadata declares bins:["curl"] but the implementation exclusively uses PowerShell cmdlets (Invoke-RestMethod, Start-Process, Get-NetTCPConnection). macOS/Linux path uses curl, but the primary platform (Windows/OpenClaw) uses PowerShell — neither shell tool is declared in allowed-tools or bins.
SKILL.md:2 Update metadata to declare appropriate allowed-tools: shell:WRITE, network:WRITE. Document PowerShell as a dependency for Windows users.
Medium Supply Chain
relay-server has unversioned dependencies
relay-server/package.json has no dependencies listed but uses Node.js built-ins only (http, fs/promises, child_process). No known vulnerabilities, but the package has no pinned versions for Node itself. server.js spawns lark-cli with shell:true which could be a supply chain risk if lark-cli is compromised.
relay-server/server.js:82 Pin Node.js version requirement. Audit lark-cli binary source. Consider removing shell:true from spawn calls.
Low Sensitive Access
relay-server spawns external CLI tool lark-cli
When MODE=lark_cli, server.js spawns 'lark-cli' binary using spawn with shell:true. While this is documented, arbitrary CLI execution on the relay server host is a privilege escalation vector if the relay server is misconfigured.
relay-server/server.js:82 Document that the relay server requires trust in the lark-cli binary. Consider pinning lark-cli version if possible.
Declared capability vs actual capability
Filesystem Pass
Declared READ
→ Inferred READ
SKILL.md: Reads config.json Network Pass
Declared READ
→ Inferred WRITE
SKILL.md: Uses Invoke-RestMethod POST/GET; bins declares curl only Shell Block
Declared NONE
→ Inferred WRITE
SKILL.md step 0.5: Start-Process to launch relay-server; run-relay.ps1: while loop with Start-Process Suspicious artifacts and egress
Medium External URL
https://img.shields.io/gitee/v/tag/qidianjuzhen/agibar-invite-skill?label=version&color=blue&sort=semver README.md:3
Medium External URL
https://img.shields.io/badge/api-REST-orange README.md:3
Medium External URL
https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue README.md:3
Medium External URL
https://gitee.com/qidianjuzhen/fork-latte-skill README.md:56
Medium External URL
https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green relay-server/README.md:3
Medium External URL
https://open.feishu.cn relay-server/README.md:28
Medium External URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal relay-server/README.md:67
Medium External URL
https://open.feishu.cn/open-apis/bitable/v1/apps/ relay-server/README.md:74
Medium External URL
https://clawhub.ai/user/moljay skill-card.md:9
Medium External URL
https://clawhub.ai/moljay/skills/fork-latte-skill skill-card.md:47
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| node | * | system | No | No package.json deps; only Node.js built-ins used (http, fs, child_process) |
| lark-cli | * | external_binary | No | Spawned as external binary when MODE=lark_cli; not pinned, shell:true used |
File composition
10 files · 697 lines
Markdown 4 files · 415 linesJavaScript 1 files · 239 linesOther 1 files · 28 linesJSON 4 files · 15 lines
Files of concern · 6
relay-server/config.json Hardcoded API key embedded in skill files
relay-server/server.js relay-server has unversioned dependencies · relay-server spawns external CLI tool lark-cli
SKILL.md Undeclared shell auto-heal with developer-specific hardcoded paths · Declared bins do not match actual tool dependencies
relay-server/README.md https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green · https://open.feishu.cn · https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal · https://open.feishu.cn/open-apis/bitable/v1/apps/
README.md https://img.shields.io/gitee/v/tag/qidianjuzhen/agibar-invite-skill?label=version&color=blue&sort=semver · https://img.shields.io/badge/api-REST-orange · https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue · https://gitee.com/qidianjuzhen/fork-latte-skill
skill-card.md https://clawhub.ai/user/moljay · https://clawhub.ai/moljay/skills/fork-latte-skill
Other files · run-relay.ps1 · package.json · _meta.json · config.example.json
Security positives
Skill design is legitimate — collecting registration data and writing to Feishu is a valid use case
Credentials (Feishu tokens) are properly contained server-side and never in the client skill
No obfuscation or base64-encoded payloads observed
No credential harvesting from the user's environment (no os.environ iteration, no ~/.ssh access)
No C2 communication or data exfiltration to unexpected endpoints
Error messages are sanitized — internal errors not exposed to users
API_KEY header validation protects against unauthenticated relay access
No malicious attack chain (reverse shell, ransomware, data theft) detected