T09 · Insecure Skill Coding Practices
- Location
index.js:17- Finding
Hardcoded Feishu Application Credentials
- Content
View full analysis
Vulnerability Details
File Location:
index.js, lines 17-18
Vulnerability Type: Hardcoded secret / plaintext sensitive credentials
Risk Level: HighVulnerable Code
js appId: process.env.FEISHU_APP_ID || 'cli_a939c44a23789bd1', appSecret: process.env.FEISHU_APP_SECRET || 'aaMNPvitP43wmkHV5Mav4VItJvOZHj5u',Technical Analysis
The source code embeds a Feishu application ID and application secret as fallback values. When
FEISHU_APP_IDandFEISHU_APP_SECRETare not set, the application automatically submits these embedded credentials to the Feishu tenant access-token endpoint.Because the secret is distributed with the project, anyone who can read the repository, package, deployment artifact, backup, or related logs can recover it. Environment-variable support does not mitigate the exposure because the hardcoded fallback remains usable independently of the intended deployment.
The credentials are used in
index.js, lines 211-214, to request a tenant access token:js const data = await feishuApiRequest('POST', 'open-apis/auth/v3/tenant_access_token/internal', { app_id: CONFIG.feishu.appId, app_secret: CONFIG.feishu.appSecret, });Attack Path
- An attacker obtains read access to the project source or a distributed Skill package.
- The attacker extracts the embedded Feishu application ID and secret from
index.js. - The attacker submits the credentials to Feishu's internal tenant access-token API.
- If the credentials remain valid, Feishu returns a tenant access token.
- The attacker uses that token to invoke Feishu APIs authorized for the application.
- The attacker may read or modify resources within the application's granted permission scope, including relevant Wiki or Bitable resources if those permissions are enabled.
Impact Assessment
Successful exploitation grants the attacker the API privileges assigned to the compromised Feishu applicat ...[truncated 561 chars]
- Remediation
View remediation
Remediation Suggestions
- Revoke and rotate the exposed Feishu application secret immediately.
- Remove the application ID and secret fallback values from source code.
- Require credentials to be supplied through environment variables or an approved secret-management service.
- Fail closed during startup when required credentials are absent instead of silently using defaults.
- Prevent secrets from entering version control through secret-scanning hooks, CI checks, and repository protection rules.
- Review repository history and distributed artifacts for copies of the exposed secret.
- Audit Feishu authentication and API access logs for suspicious token issuance or resource access.
- Restrict the Feishu application's permissions to the minimum resources and operations required.
- Establish periodic credential rotation and incident-response procedures for future exposure.