feishu-doc Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

feishu-doc is an AI agent skill, created by autogame-17 and published at openclaw/skills. ClawSecure audited feishu-doc across 27 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 93/100 (Safe). The 3 findings concentrate in Policy Violation, Verification and ReDoS, including ReDoS vulnerability: Nested quantifiers (potential catastrophic... and No GitHub source URL - cannot verify agent origin. None were rated high or critical severity.

Is feishu-doc safe?

ClawSecure audited feishu-doc and assigned a security score of 93/100 (Safe), identifying 3 findings across Policy Violation and Verification. Review the findings below before installing.

What did ClawSecure find in feishu-doc?

ClawSecure identified 3 findings in feishu-doc, concentrated in Policy Violation, Verification and ReDoS. The most severe include ReDoS vulnerability: Nested quantifiers (potential catastrophic... and No GitHub source URL - cannot verify agent origin.

How was feishu-doc audited?

ClawSecure ran feishu-doc through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 27 files from openclaw/skills.

What does a score of 93 mean?

ClawSecure assigned feishu-doc a security score of 93/100, placing it in the Safe range. Scores of 80 or above qualify for ClawSecure Verified status; the 3 findings detected are lower-severity. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for feishu-doc

ClawSecure detected 3 security findings in feishu-doc, spanning Policy Violation, Verification and ReDoS.

medium · ReDoS vulnerability: Nested quantifiers (potential catastrophic.... ReDoS finding detected in sheet.js:67.
low · No GitHub source URL - cannot verify agent origin. Verification finding.
info · Skill manifest does not include a 'license' field. Specifying a license.... Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for feishu-doc

Resolve policy violations

feishu-doc trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Fix ReDoS-prone patterns

feishu-doc contains regular expressions vulnerable to catastrophic backtracking (ReDoS). Replace vulnerable patterns, bound input length, and prefer linear-time matching so a crafted input cannot hang the agent.

Pin dependencies to exact versions

Unpinned dependencies allow supply-chain attacks where a compromised version is pulled in automatically. Use exact version numbers in package.json (for example 1.2.3 instead of ^1.2.3) to keep unauthorized code out of your dependency tree. ClawSecure checks every dependency against known CVE databases.

Add a config.json permissions manifest

A config.json file declares what permissions an agent component needs: file system access, network requests, shell execution and more. Without it, users have no visibility into what the component can do before installing. Adding a permissions manifest is the single most impactful security improvement for any AI agent skill.

Related Security Research

OWASP ASI Top 10 Explained: The Complete Guide to AI Agent Security Standards→Understanding Our 3-Layer Audit Protocol→Why Generic Scanners Fail at AI Agent Security→

Related AI Agent Security Audits

@mohtasham/md-to-docxScore 85/100 pptxScore 93/100 summarizeScore 95/100 Powerpoint / PPTXScore 95/100 cve-2026-42945-nginx-rewrite-analysisScore 85/100

Scanned on February 16, 2026. feishu-doc is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan