Feishu Contacts Sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:05 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it stores Feishu contact data in a prompt-loaded file and can optionally keep rewriting it on a schedule, which needs careful review.

Install only if you trust the Feishu tenant data source and are comfortable placing a name-to-open_id directory into USER.md. Review the generated table before restarting the gateway, avoid the cron option unless you need it, and prefer adding validation or escaping for contact names and open_ids before using this in a shared or high-privilege agent environment.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Warning

• Location: SKILL.md:67

Finding

Optional Crontab Creates Persistent Unattended Execution

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/sync_feishu_contacts.py:62

Finding

Unescaped Feishu Contact Data Can Poison Persistent Agent Context

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/sync_feishu_contacts.py (reported line 36)May include surrounding context.

python

print(f"Available accounts: {list(cfg.get('channels', {}).get('feishu', {}).get('accounts', {}).keys())}")
        sys.exit(1)

    # 2. Get tenant access token
    req = urllib.request.Request(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
        data=json.dumps({

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the user to run a script that reads credentials from a config file, makes network calls to Feishu, and writes data into USER.md, yet it declares no explicit tool scope or permission boundaries. This is dangerous because it hides the operational and trust surface of the skill, making it easier for an agent or user to invoke file and network actions without clear review or least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs users to embed a full open_id-to-name contact table into USER.md, but it does not clearly warn that this modifies a prompt-injected file and stores sensitive identity mapping data there. This creates privacy and integrity risk because USER.md may be broadly exposed to the agent context, may persist stale or unauthorized personnel data, and may be overwritten or expanded without the user's informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The required USER.md format and the AGENTS.md startup instruction are provided as Chinese text and presented as content the user should add, with no opt-in or alternative language option. This creates a language-policy issue because the skill implicitly mandates a specific language rather than allowing the user's preferred locale.

Content

No source excerpt is available for this finding.

Tainted flow: 'req' from urllib.request.urlopen (line 58, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/sync_feishu_contacts.py (reported line 45)May include surrounding context.

python

}).encode(),
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read())
    if resp.get("code", 0) != 0:
        print(f"Error getting token: {resp.get('msg', 'unknown error')}")
        sys.exit(1)

Tainted flow: 'req' from urllib.request.urlopen (line 58, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/sync_feishu_contacts.py (reported line 62)May include surrounding context.

python

"Authorization": f"Bearer {token}",
            "Content-Type": "application/json"
        })
        data = json.loads(urllib.request.urlopen(req).read()).get("data", {})
        for u in data.get("items", []):
            name = u.get("name", "")
            open_id = u.get("open_id", "")