@m1heng-clawd/feishu Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

@m1heng-clawd/feishu is an AI agent skill, created by m1heng and published at m1heng/clawdbot-feishu. ClawSecure audited @m1heng-clawd/feishu across 92 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (Critical). The 57 findings concentrate in Supply Chain, Permissions Manifest and Malicious Code, including Vulnerability in openclaw@2026.3.1: OpenClaw: Pairing-scoped device... and Vulnerability in openclaw@2026.3.1: OpenClaw: WebSocket shared-auth.... 26 were rated high or critical severity.

Is @m1heng-clawd/feishu safe?

ClawSecure audited @m1heng-clawd/feishu and assigned a security score of 0/100 (Critical), identifying 57 findings across Supply Chain and Permissions Manifest. Review the findings below before installing.

What did ClawSecure find in @m1heng-clawd/feishu?

ClawSecure identified 57 findings in @m1heng-clawd/feishu, concentrated in Supply Chain, Permissions Manifest and Malicious Code. 26 were rated high or critical severity. The most severe include Vulnerability in openclaw@2026.3.1: OpenClaw: Pairing-scoped device... and Vulnerability in openclaw@2026.3.1: OpenClaw: WebSocket shared-auth....

How was @m1heng-clawd/feishu audited?

ClawSecure ran @m1heng-clawd/feishu through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 92 files from m1heng/clawdbot-feishu.

What does a score of 0 mean?

ClawSecure assigned @m1heng-clawd/feishu a security score of 0/100, placing it in the Critical range. This is driven by 57 findings led by Supply Chain that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for @m1heng-clawd/feishu

ClawSecure detected 57 security findings in @m1heng-clawd/feishu, spanning Supply Chain, Permissions Manifest, Malicious Code and Code Injection.

critical · Vulnerability in openclaw@2026.3.1: OpenClaw: Pairing-scoped device.... Supply Chain finding detected in package.json.
critical · Vulnerability in openclaw@2026.3.1: OpenClaw: WebSocket shared-auth.... Supply Chain finding detected in package.json.
critical · Vulnerability in vitest@2.1.8: Vitest allows Remote Code Execution when.... Supply Chain finding detected in package.json.
high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in README.md.
high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in doc-write-service.ts.
high · Vulnerability in music-metadata@11.12.1: music-metadata has an infinite.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw: Gateway `agent` calls.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw: Sandboxed.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw: Leaf subagents could.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw: Untrusted web origins can.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw bootstrap setup codes.... Supply Chain finding detected in package.json.
high · Vulnerability in openclaw@2026.3.1: OpenClaw: fetch-guard forwards.... Supply Chain finding detected in package.json.

Showing the 12 highest-severity of 57 findings. The full interactive list appears below.

3-Layer Audit Protocol

Security Recommendations for @m1heng-clawd/feishu

Update and pin dependencies

@m1heng-clawd/feishu depends on packages with supply-chain risk. Pin every dependency to an exact version, update packages with known CVEs to patched releases, and re-audit after each change. ClawSecure checks every dependency against known CVE databases.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Audit external network connections

@m1heng-clawd/feishu connects to external endpoints. Verify every outbound connection goes to a trusted destination. Unauthorized callbacks are a primary indicator of ClawHavoc malware and data exfiltration. ClawSecure's proprietary engine monitors for known malicious endpoints including C2 infrastructure.

Related Security Research

AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

awesome-openclaw-skillsScore 0/100 understand-anythingScore 0/100 memUScore 0/100 cybersecurity-skillsScore 0/100 clawdtmScore 0/100

Scanned on March 20, 2026. @m1heng-clawd/feishu is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan