T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:213- Finding
Mandatory Retention of Bot Edit Access After Ownership Transfer
- Content
View full analysis
- Remediation
View remediation
Security audit
feishu-bitable-builder
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Feishu Bitable builder, but it tells the bot to keep edit access after handoff and lacks strong safeguards around permissions, deletion, automation, and external data sharing.
Install only if you intend to let an agent build and modify Feishu Bitable systems. Before running it, confirm the target Feishu tenant, app, users, and exact permission changes; remove the bot's edit access after delivery unless you explicitly approve time-limited support access. Review any automation that deletes data, auto-approves purchases, sends customer messages, or exports data outside Feishu, and limit payloads to necessary fields.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description and trigger conditions are broad enough to match many routine business-system requests, which can cause the agent to invoke this skill in situations where users did not explicitly request Feishu/Bitable actions. In a tool-enabled environment, over-broad routing increases the chance of unintended data-structure creation, workflow setup, or permission-affecting operations on business data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to configure permissions and later transfer ownership, but it does not require explicit user confirmation, identity verification of the recipient, or a warning that access-control changes can permanently expose or reassign sensitive business data. Because this skill manages operational systems like CRM, inventory, and project data, permission mistakes could grant broad access or lock out intended owners.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill encourages HTTP requests and Webhook-based integrations without instructing the agent to classify data, minimize transmitted fields, validate endpoints, or warn users about sending potentially sensitive CRM, project, or inventory data to external systems. In this context, external integrations materially increase exfiltration and compliance risk because the managed tables are likely to contain personal, commercial, or operationally sensitive information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly instructs users on delete operations for records, tasks, and calendar events, but it provides no caution about irreversibility, scope validation, approval gates, or backup/recovery considerations. In an automation/workflow skill, this can lead to accidental or over-broad destructive actions being embedded into unattended workflows, causing data loss or operational disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTTP request guidance shows how to transmit table data to external APIs but does not warn about privacy, compliance, data minimization, secret handling, or third-party trust boundaries. Because this skill is specifically about designing business data systems, users may automate transfer of customer or operational data to external services without understanding the security and legal implications.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md 场景：同步数据到外部系统 操作：HTTP请求 方法：POST URL：https://api.example.com/sync 请求体： { "customer": "{{触发.客户名称}}",
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The title and all subsequent guidance are presented only in Chinese, which can amount to a language/locale policy violation when no user opt-in or justification is provided. The file does not state that the skill or reference is intentionally limited to Chinese-speaking users or a China-specific compliance context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, and nowhere indicates that the language is optional, configurable, or limited to a China-specific audience. Under the policy rule for language/locale constraints, forcing a single language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file contains user-facing natural language content only in Chinese, beginning with the title and continuing throughout the document. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation when no alternative language option or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all user-facing guidance in Chinese and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file outlines automations that send messages containing customer names, follow-up content, and service details to supervisors or teams. Because the description presents data-sharing behavior without any warning about privacy, recipient scope, or sensitive-content handling, it lacks user disclosure for behaviors that could affect user data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This section describes automatically creating purchase requests and auto-approving purchase orders based on conditions, which can affect business records and downstream operations. The file does not warn users about the need for validation, audit review, or safeguards against unintended automation outcomes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The document specifies AI analysis, automatic classification, automatic routing, and automatic replies to customers, all of which can affect customer communications and service outcomes. There is no visible caution that these actions may be inaccurate and should be monitored or reviewed, so the user is not warned about system-integrity and user-impact risks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill reference is written in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.