feishu-doc-collab 安全扫描报告 — 低风险 | ClawSafe

25 /100

feishu-doc-collab

Enable real-time AI collaboration in Feishu (Lark) documents — turns any Feishu doc into a live human-AI conversation space with structured in-doc chat protocol and optional Bitable task board integration.

A legitimate Feishu document collaboration skill for OpenClaw. The shell script patching, character-code Python obfuscation, and system file modification are unusual but serve clear, documented purposes with no data exfiltration or credential theft.

技能名称feishu-doc-collab

分析耗时57.9s

引擎pi

✓

可以安装

Approve for use. No undeclared sensitive behavior found. The shell script's Python one-liner obfuscation (character codes) and system file patching are documented. Consider clarifying shell:WRITE in SKILL.md's capability declaration for transparency.

安全发现 5 项

严重性	安全发现	位置
低危	shell:WRITE not declared in allowed-tools section 文档欺骗 SKILL.md does not list shell execution in its allowed-tools section, yet patch-monitor.sh requires Bash (set -e, cp, grep, python3). The documentation describes 'bash ./scripts/patch-monitor.sh' as a setup step but never maps this to a declared resource level. `allowed-tools mapping: Bash→shell:WRITE, Read→filesystem:READ` → Add shell:WRITE to the skill's declared capabilities or restructure the patch script as a setup-time-only step that is clearly scoped as a prerequisite.	`SKILL.md:1`
低危	Python config extraction uses character-code string obfuscation 代码混淆 patch-monitor.sh line 47 uses chr() character-code encoding to construct JSON field names ($CONFIG, agent_name) inside a python3 -c call. This is visually suspicious but functionally equivalent to a plain jq or python3 -r json.load() call. `python3 -c "import json; print(json.load(open(chr(39)+str('''$CONFIG''')[:0]+'''$CONFIG'''+chr(39)))[chr(39)+'agent_name'+chr(39)])"` → Replace with a readable equivalent: python3 -c "import json,sys; print(json.load(open('$CONFIG'))['agent_name'])" — or use jq for clarity.	`scripts/patch-monitor.sh:47`
低危	Hardcoded agent name 'MyBot' in patched monitor.js 文档欺骗 The embedded instructions in _handleDriveEditEvent hardcode 'MyBot' as the bot identity check (sender is yourself → skip, receiver not 'MyBot' → skip). This should be read dynamically from config.json at patch time, not hardcoded. `- If sender is yourself (MyBot) → do NOTHING, reply NO_REPLY - If receiver is not your name (MyBot) and not "all" → do NOTHING` → Use a placeholder (e.g., {{AGENT_NAME}}) in the reference file and substitute it at patch time using sed, matching the pattern used in the existing backup mechanism.	`references/monitor-full-patched.js:86`
提示	System file modification without version control 权限提升 The patch script directly overwrites OpenClaw's monitor.js/ts in the node_modules or ~/.openclaw/extensions directory. While backup is created, the patch is not tracked by a package manager and must be re-applied after updates. This is documented but remains a fragile integration point. `cp "$REF" "$MONITOR"` → Consider a more robust integration mechanism (e.g., OpenClaw plugin hook API) instead of direct file patching. Document the re-patch requirement prominently.	`scripts/patch-monitor.sh:54`
提示	Reads ~/.openclaw/openclaw.json at runtime 敏感访问 The patched monitor.js reads the hooks token and gateway port from ~/.openclaw/openclaw.json at runtime using synchronous fs.readFileSync. This is necessary for the integration but reads a config file containing sensitive credentials. const cfgRaw = fs2.readFileSync(`${process.env.HOME \|\| "/root"}/.openclaw/openclaw.json`, "utf-8"); → Document this runtime access clearly. The token is used only for local 127.0.0.1 POST authentication, which is acceptable. Ensure openclaw.json permissions are restricted to the openclaw user.	`references/monitor-full-patched.js:75`

资源类型	声明权限	推断权限	状态	证据
文件系统	`WRITE`	`WRITE`	✓ 一致	patch-monitor.sh:42 — cp references/monitor-full-patched.js to monitor.js
网络访问	`READ`	`READ`	✓ 一致	references/feishu-app-setup.md references open.feishu.cn URLs (documentation)
命令执行	`NONE`	`WRITE`	✗ 越权	patch-monitor.sh:1 — set -e; cp; grep; python3; uses Bash extensively, not decla…
环境变量	`NONE`	`READ`	✗ 越权	monitor-full-patched.js:75 — reads process.env.HOME for path construction; envir…
技能调用	`NONE`	`NONE`	—	No skill_invoke usage observed
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser access
数据库	`NONE`	`NONE`	—	No direct database access

2 项发现

🔗

中危外部 URL 外部 URL

https://open.feishu.cn/app

references/feishu-app-setup.md:16

🔗

中危外部 URL 外部 URL

http://127.0.0.1:

references/manual-patch.md:19

目录结构

8 文件 · 29.7 KB · 797 行

Markdown 5f · 528L JavaScript 1f · 193L Shell 1f · 68L JSON 1f · 8L

├─ ▾ 📁 assets

│ └─ 📝 DOC_PROTOCOL_TEMPLATE.md Markdown 59L · 1.4 KB

├─ ▾ 📁 references

│ ├─ 📝 bitable-task-protocol.md Markdown 53L · 2.0 KB

│ ├─ 📝 feishu-app-setup.md Markdown 74L · 2.4 KB

│ ├─ 📝 manual-patch.md Markdown 71L · 3.4 KB

│ └─ 📜 monitor-full-patched.js JavaScript 193L · 9.2 KB

├─ ▾ 📁 scripts

│ └─ 🔧 patch-monitor.sh Shell 68L · 2.1 KB

├─ 🔑 config.json ⚠ JSON 8L · 131 B

└─ 📝 SKILL.md Markdown 271L · 9.2 KB

安全亮点

✓ No base64-encoded payloads, eval(), or atob() usage found in any script or JS file

✓ No remote script download (curl|bash, wget|sh) — reference file is bundled locally

✓ No credential exfiltration — hooks token read stays local, used only for localhost authentication

✓ Backup (.bak) is created before patching system files

✓ Idempotent patch — script checks for existing patch markers before modifying files

✓ No ~/.ssh, ~/.aws, .env, or other sensitive credential paths accessed

✓ No network calls to external IPs — all POSTs go to 127.0.0.1 only

✓ Patch mechanism is fully documented in SKILL.md and references/

✓ Anti-loop logic (bot self-edit check) prevents infinite loops

✓ 30-second debounce prevents event storms and token waste