feishu-bridge
Verdict safe, but 2 findings (2 medium), mainly data exfiltration, resource abuse. Most recent scan 2026-02-06.
The feishu-bridge skill presents MODERATE security risk. The skill provides legitimate functionality for bridging Feishu bot messages to Clawdbot via WebSocket, with a reasonable architecture that avoids requiring public servers. However, it has several security concerns: plaintext secret storage without proper validation (MEDIUM), potential resource exhaustion from unbounded WebSocket reconnections (MEDIUM), missing manifest metadata (LOW), and unpinned npm dependencies (LOW). The skill does not exhibit malicious behavior such as data exfiltration, prompt injection, or command injection. The primary risks are operational security issues around credential management and service reliability. The skill would benefit from: stronger secret management (OS keychain integration), connection resilience patterns (backoff, circuit breakers), complete manifest metadata, and dependency version pinning.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Connect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning.
- Package
- 5 files, 20 KB
- SKILL.md
- 258 words, 12+ sections
- Code
- JavaScript (2)
SKILL.md covers: Feishu Bridge · Architecture · Setup · 1. Create Feishu bot · 2. Store secret · 3. Install & run · 4. Auto-start (macOS) · Diagnostics · Check service · Logs · Stop · Group chat behavior
Findings
MEDIUM Hardcoded Secret Path Without Validation Data Exfiltrationllm
The skill instructs users to store the Feishu app secret in a plaintext file at ~/.clawdbot/secrets/feishu_app_secret. While file permissions are set to 600, there is no validation that the secret file exists, is properly protected, or that the secret itself is valid before use. This could lead to exposure if the file is accidentally created with wrong permissions or if the path is predictable for local privilege escalation attacks.
SKILL.md
echo "YOUR_APP_SECRET" > ~/.clawdbot/secrets/feishu_app_secret
chmod 600 ~/.clawdbot/secrets/feishu_app_secretMEDIUM WebSocket Long-Connection Without Reconnection Limits Resource Abusellm
The bridge establishes a WebSocket long-connection to both Feishu cloud and Clawdbot Gateway without documented reconnection limits, backoff strategies, or circuit breakers. If the connection fails repeatedly, this could lead to resource exhaustion through unbounded retry attempts, excessive logging, or connection storms.
SKILL.md
Feishu SDK connects outbound (no inbound port / public IP needed)
Bridge authenticates to Gateway using the existing gateway tokenWhat is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 4.9 KB |
SKILL.md | doc | 2.4 KB |
bridge.mjs | script | 9.7 KB |
package.json | config | 421 B |
setup-service.mjs | script | 2.3 KB |
External hosts referenced
open.feishu.cn www.apple.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
FEISHU_APP_ID FEISHU_APP_SECRET_PATH APP_ID CLAWDBOT_AGENT_ID CLAWDBOT_CONFIG_PATH BRIDGE_PATH GATEWAY_PORT NODE_PATH SECRET_PATH WORK_DIR
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/feishu-bridge
- Raw scan result: feishu-bridge-scan.json
- Badge for your README:
- Request a re-scan