Submit #852964: Sipeed PicoClaw <= v0.2.9 Missing Authorization (CWE-862)

# Technical Details
A missing authorization vulnerability exists in Feishu reply-context expansion in `pkg/channels/feishu/feishu_64.go` and `pkg/channels/feishu/feishu_reply.go` of PicoClaw.

The application fails to re-check `allow_from` for fetched parent/replied messages. The current Feishu event sender is authorized, but `prependReplyContext` fetches the replied message and prepends its body into downstream model input without validating the parent message sender.

# Vulnerable Code
File: `pkg/channels/feishu/feishu_64.go`
Method: `handleMessageReceive`
Why: Applies `IsAllowedSender` only to the live sender, then calls `prependReplyContext` for replies/threads.

File: `pkg/channels/feishu/feishu_reply.go`
Method: `prependReplyContext`
Why: Resolves and fetches the target message, reads `repliedMessage.Body.Content`, and prepends it without checking whether the parent sender is allowlisted.

# Reproduction
1. Configure Feishu `allow_from` to allow user Alice but not user Mallory.
2. Have Mallory create a group message containing `CANARY_UNTRUSTED_PARENT`.
3. Have Alice reply to Mallory's message with normal allowed content.
4. Observe PicoClaw imports Mallory's parent content into the inbound model context.
5. Run a control where the parent is allowlisted and observe expected allowed behavior.

# Impact
- Bypasses the configured Feishu sender trust boundary.
- Lets non-allowlisted users inject historical message content into trusted agent/model input.
- Can influence downstream tool use, reasoning, or automation decisions that operators intended to restrict to trusted senders.

• Source: ⚠️ https://github.com/sipeed/picoclaw/issues/3082
• User: Eric-i (UID 97584)
• Submission: 06/09/2026 13:33 (1 month ago)
• Moderation: 07/18/2026 09:22 (1 month later)
• Status: Accepted
• VulDB entry: 380013 [Sipeed PicoClaw up to 0.2.9 Group Message feishu_64.go handleMessageReceive authorization]
• Points: 20