中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
feishu-integration
飞书开放平台完整对接方案，支持文档管理、知识库操作、文件上传、Markdown导入、消息解析、OCR识别、群欢迎机器人等功能
Legitimate Feishu API integration skill with no malicious behavior; primary concern is hardcoded credentials in config/feishu.env that SKILL.md explicitly warns against committing.
Skill Namefeishu-integration
Duration64.8s
Enginepi
✓
Safe to install
Remove hardcoded app_secret from config/feishu.env and use environment variables only. Add config/feishu.env to .gitignore. Otherwise, the skill's declared and actual capabilities are consistent.

Findings 2 items

Severity Finding Location
Medium
Hardcoded application credentials in committed config file Supply Chain
config/feishu.env contains a hardcoded FEISHU_APP_SECRET (LuSwVCJUMGppIiM8FBMWfcFtMuAIRzqh) which is committed to the repository. SKILL.md warns 'app_secret 不要提交到代码仓库' but provides no enforcement mechanism. An attacker with repository access could extract and misuse these credentials.
FEISHU_APP_SECRET=LuSwVCJUMGppIiM8FBMWfcFtMuAIRzqh
→ Move credentials to environment variables only. Add config/feishu.env to .gitignore. Use: FEISHU_APP_SECRET=${FEISHU_APP_SECRET:-} and source from the environment.
 config/feishu.env:1
Low
requests library version not pinned in Python scripts Supply Chain
group-welcome.py and other Python scripts import requests but do not specify a version constraint. While requests is a widely-used library, unpinned versions could theoretically pull a compromised dependency.
import requests
→ Add a requirements.txt file with pinned versions: requests>=2.31.0
 scripts/group-welcome.py:28
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned All curl/requests calls go to open.feishu.cn only
Shell NONE WRITE ✓ Aligned group-welcome.py:178 calls subprocess.run() for feishu-auth.sh; documented but n…
Filesystem NONE READ ✓ Aligned group-welcome.py:95 reads ~/.openclaw/.env; legitimate for config loading
Environment NONE READ ✓ Aligned Scripts read FEISHU_APP_ID/SECRET from config files and env vars; declared in do…
Clipboard NONE NONE — No clipboard access detected
Browser NONE NONE — No browser access detected
Database NONE NONE — No database access detected
Skill Invoke NONE NONE — No cross-skill invocation detected
33 findings
🔗
Medium External URL 外部 URL
https://uniquecapital.feishu.cn/docx/BZTvd4SMSo6OzsxodHnckHh8nZb
CHANGELOG.md:91
🔗
Medium External URL 外部 URL
https://open.feishu.cn/document/
CHANGELOG.md:148
🔗
Medium External URL 外部 URL
https://docs.openclaw.ai/
CHANGELOG.md:149
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal
SKILL.md:176
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/
SKILL.md:196
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/NEW_API_PATH
SKILL.md:291
🔗
Medium External URL 外部 URL
https://dotenvx.com
reference-feishu-common/package-lock.json:76
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages/$
reference-feishu-message/get.js:45
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/p2p_chats
reference-feishu-message/get_latest_file.js:38
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages?container_id_type=chat&container_id=$
reference-feishu-message/get_latest_file.js:53
🔗
Medium External URL 外部 URL
https://www.patreon.com/feross
reference-feishu-message/package-lock.json:475
🔗
Medium External URL 外部 URL
https://feross.org/support
reference-feishu-message/package-lock.json:479
🔗
Medium External URL 外部 URL
https://buymeacoffee.com/borewit
reference-feishu-message/package-lock.json:564
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/files
reference-feishu-message/send-audio.js:68
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$
reference-feishu-message/send-audio.js:134
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/medias/upload_all
references/import-workflow.md:28
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/import_tasks
references/import-workflow.md:56
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/import_tasks/7605680347254590654
references/import-workflow.md:90
🔗
Medium External URL 外部 URL
https://moxunkeji.feishu.cn/docx/V4mYdLUc3oIAklxG1ducsbTQnKc
references/import-workflow.md:102
🔗
Medium External URL 外部 URL
https://open.feishu.cn/document/server-docs/im-v1/message/message-content
references/message-parsing.md:237
🔗
Medium External URL 外部 URL
https://open.feishu.cn/document/server-docs/ai/optical_char_recognition-v1/image/recognize_basic
references/message-parsing.md:238
🔗
Medium External URL 外部 URL
https://config-center/api/feishu/token
references/token-management.md:44
🔗
Medium External URL 外部 URL
https://open.feishu.cn
references/token-management.md:94
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/docx/v1/documents/$
scripts/feishu-api.sh:21
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/wiki/v2/spaces
scripts/feishu-api.sh:137
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/wiki/v2/spaces/$
scripts/feishu-api.sh:146
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/files
scripts/feishu-api.sh:172
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/files/upload_all
scripts/feishu-api.sh:190
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/drive/v1/import_tasks/$
scripts/feishu-api.sh:248
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis
scripts/feishu-message-parser.py:19
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/optical-char-recognition/v1/image/recognize_basic
scripts/feishu-ocr.py:41
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/chats/
scripts/group-welcome.py:317
🔗
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages
scripts/group-welcome.py:459

File Tree

35 files · 149.4 KB · 5242 lines
Markdown 8f · 1384L JSON 6f · 1179L Python 3f · 1156L JavaScript 12f · 978L Shell 5f · 540L Env 1f · 5L
├─ ▾ 📁 config
│ └─ 📄 feishu.env Env 5L · 177 B
├─ ▾ 📁 examples
│ ├─ 🔧 ocr_image.sh Shell 21L · 346 B
│ ├─ 🔧 parse_rich_text.sh Shell 20L · 524 B
│ └─ 🔧 parse_text.sh Shell 20L · 350 B
├─ ▾ 📁 reference-feishu-common
│ ├─ 📋 _meta.json JSON 17L · 461 B
│ ├─ 📜 feishu-client.js JavaScript 1L · 40 B
│ ├─ 📜 index.js JavaScript 138L · 5.3 KB
│ ├─ 📋 package-lock.json JSON 308L · 10.4 KB
│ ├─ 📋 package.json JSON 15L · 367 B
│ └─ 📝 SKILL.md Markdown 29L · 750 B
├─ ▾ 📁 reference-feishu-message
│ ├─ 📋 _meta.json JSON 32L · 991 B
│ ├─ 📜 create_chat.js JavaScript 73L · 2.5 KB
│ ├─ 📜 disband_chat.js JavaScript 48L · 1.4 KB
│ ├─ 📜 get_chat_info.js JavaScript 45L · 1.1 KB
│ ├─ 📜 get_latest_file.js JavaScript 70L · 2.9 KB
│ ├─ 📜 get.js JavaScript 138L · 5.4 KB
│ ├─ 📜 index.js JavaScript 107L · 3.7 KB
│ ├─ 📜 list_pins_v2.js JavaScript 78L · 2.4 KB
│ ├─ 📜 list_pins.js JavaScript 81L · 2.2 KB
│ ├─ 📋 package-lock.json JSON 793L · 28.2 KB
│ ├─ 📋 package.json JSON 14L · 357 B
│ ├─ 📜 send-audio.js JavaScript 166L · 5.4 KB
│ ├─ 📜 send.js JavaScript 33L · 972 B
│ └─ 📝 SKILL.md Markdown 56L · 1.4 KB
├─ ▾ 📁 references
│ ├─ 📝 api-reference.md Markdown 243L · 4.4 KB
│ ├─ 📝 import-workflow.md Markdown 193L · 3.6 KB
│ ├─ 📝 message-parsing.md Markdown 246L · 5.2 KB
│ └─ 🔑 token-management.md ⚠ Markdown 141L · 2.8 KB
├─ ▾ 📁 scripts
│ ├─ 🔧 feishu-api.sh Shell 380L · 10.1 KB
│ ├─ 🔧 feishu-auth.sh Shell 99L · 2.3 KB
│ ├─ 🐍 feishu-message-parser.py Python 271L · 9.0 KB
│ ├─ 🐍 feishu-ocr.py Python 76L · 1.9 KB
│ └─ 🐍 group-welcome.py Python 809L · 20.5 KB
├─ 📝 CHANGELOG.md Markdown 149L · 3.5 KB
└─ 📝 SKILL.md Markdown 327L · 8.7 KB

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
requests * pip No Version not pinned
axios ^1.6.0 npm No Pinned in reference-feishu-common
dotenv ^16.3.1 npm No Pinned in reference-feishu-common

Security Positives

✓ All network requests target only open.feishu.cn — no data exfiltration to external servers
✓ SKILL.md accurately describes all core capabilities with no hidden functionality
✓ No base64-encoded execution, eval(), or obfuscated code present
✓ No credential harvesting beyond what's needed for Feishu API authentication
✓ No access to sensitive paths (~/.ssh, ~/.aws, ~/.netrc) or cron/persistence mechanisms
✓ Token caching uses /tmp/ (non-persistent) which is appropriate for transient credentials
✓ shell:WRITE via subprocess is used only for feishu-auth.sh (legitimate token management)
✓ Documentation includes explicit security reminders and best practices