feishu-evolver-wrapper

Pass

Audited by Gen Agent Trust Hub on Mar 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses child_process modules (execSync, spawn, spawnSync) to manage system-level operations. This includes executing Git commands for code synchronization and interacting with the OpenClaw CLI to manage cron-based persistence and agent sessions.
  • [COMMAND_EXECUTION]: index.js employs new Function() for dynamic parsing of agent-generated payloads when standard JSON parsing fails, enabling robust data bridging between the evolution 'brain' and 'hand' agents.
  • [DATA_EXFILTRATION]: report.js and export_history.js transmit evolution history, system metrics, and activity dashboards to the Feishu (Lark) Open API. This is the primary intended function of the wrapper.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to open.feishu.cn to deliver reports. Feishu is a well-known enterprise communication service and is treated as a safe destination for these notifications.
  • [SAFE]: The skill incorporates defensive security practices by implementing a scanForSecrets utility in feishu-helper.js. This utility uses regular expressions to detect and block the transmission of sensitive patterns (such as Anthropic API keys and private keys) before they reach external endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 28, 2026, 11:30 AM