Feishu User Auth

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it runs a Feishu OAuth flow and stores local user tokens for later Bitable syncing, but users should treat the cached tokens as sensitive.

Install only if you are comfortable granting a Feishu app user-level authorization and storing Feishu access and refresh tokens on this machine. Keep the cache path private, delete ~/.codex/feishu-auth/content-system-sync.json or revoke the Feishu app authorization if no longer needed, and avoid sharing the generated auth report if name/open_id metadata is sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill describes behavior that reads and writes local files, including storing OAuth tokens, but it does not declare any explicit tool scope or permissions boundary. That makes the capability less transparent to users and reviewers, increasing the chance of unintended file access or persistence without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: feishu-user-auth
description: Complete one-time Feishu browser authorization and cache a local `user_access_token` so later `feishu-bitable-sync` runs can write Bitable rows as the current user instead of app identity.
---

# feishu-user-auth

• Confidence: 90% confidence
• Finding: The duplicated finding points to the same core issue: the skill enables ongoing authenticated actions by caching user tokens for reuse. In this context, the risk is elevated because the persisted credentials are intended to authorize write operations to Bitable as the user rather than as an app identity.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: feishu-user-auth
description: Complete one-time Feishu browser authorization and cache a local `user_access_token` so later `feishu-bitable-sync` runs can write Bitable rows as the current user instead of app identity.
---

# feishu-user-auth

• Confidence: 90% confidence
• Finding: The duplicated finding points to the same core issue: the skill enables ongoing authenticated actions by caching user tokens for reuse. In this context, the risk is elevated because the persisted credentials are intended to authorize write operations to Bitable as the user rather than as an app identity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that it will cache `user_access_token` and `refresh_token` locally, but it does not present this as a prominent security warning or explain the consequences of credential theft from disk. Locally persisted OAuth tokens can allow account actions as the user if another local process or attacker gains access to the file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The authorization flow writes user identity and token-related metadata such as open_id, issued_at, expires_at, refresh_expires_at, cache_path, and redirect_uri into a published markdown file under content-production/published. In this skill context, that file is intended for broader workspace consumption, so exposing authentication metadata and local token cache locations increases the chance of privacy leakage, credential targeting, or misuse by other tools or users with access to published artifacts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest explicitly states that a Feishu user access token will be cached locally, but provides no indication of storage protections, scope minimization, expiry handling, or user-facing warning about the sensitivity of the credential. Because a user access token can let later sync operations act as the current user, insecure or undisclosed local token persistence increases the risk of account misuse if the host is shared, compromised, or logs/backups expose the cache.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The manifest headings and instructions are hard-coded in Chinese, including status sections and next-step guidance, with no indication that the user can select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Static analysis

No suspicious patterns detected.