Security audit

Feishu Doc Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill’s document-reading purpose is coherent, but it needs Review because its integration and packaging guidance can expose credentials or enable unsafe command execution.

Install only if you are comfortable giving the skill a Feishu app ID/secret and letting it print retrieved Feishu content into your agent session or logs. Use the smallest Feishu permissions possible, avoid recursive wiki reads unless needed, do not follow the exec interpolation example with untrusted input, and do not package or share a configured copy unless credential files are removed first.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/package_skill.py:47
Finding: Credential File Is Included in Generated Skill Archives
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: USAGE_EXAMPLES.md:91
Finding: Shell Command Injection in Documented AI-Agent Integration
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:2
Finding: Unpinned Runtime Dependency Allows Unreviewed Future Artifacts
Content: View full analysis
=2.25.0 ``` ### Technical Analysis The lower-bound-only constraint permits installation of any future `requests` release accepted by the package resolver. No lock file or cryptographic hashes constrain the artifact that will be installed. The audited package name is legitimate, and no evidence indicates that the current dependency is malicious. The security weakness is that a future installation can resolve to code that was not part of this audit. This creates a supply-chain exposure if an upstream release or distribution artifact is compromised and also prevents reproducible builds. Because `requests` is imported by the Skill’s executable scripts, installed package code runs within the same Python process and security context as the Skill. ### Attack Path 1. A user follows the documented installation command using `requirements.txt`. 2. The package resolver selects a release newer than the version reviewed or tested by the project. 3. A compromised, malicious, or otherwise unsafe future artifact is downloaded from the configured package index. 4. The dependency is installed without hash verification. 5. The Skill imports `requests`. 6. Dependency initialization or invoked dependency functionality executes with the privileges of the Skill process. ### Impact Assessment A compromised dependency could execute arbitrary Python code with the privileges of the user or service running the Skill. That context may have access to: - `FEISHU_APP_ID` and `FEISHU_APP_SECRET`. - `reference/feishu_config.json`. - Tenant access tokens held in process memory. - Retrieved Feishu document content. - Local files and network access available to the process. The finding does not demonstrate an existing malicious ...[truncated 88 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (45)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · INTEGRATION.md (reported line 94)May include surrounding context.
md
- **Large documents**: The full blocks structure can be large; consider using `--format simple` for just text - **Rate limiting**: Feishu API has rate limits; implement caching when possible - **Token expiration**: Access tokens expire after 2 hours; the script handles automatic refresh ### 6. Security Best Practices

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 126)May include surrounding context.
md
- **Large documents**: The full blocks structure can be large; consider using `--format simple` for just text - **Rate limiting**: Feishu API has rate limits; implement caching when possible - **Token expiration**: Access tokens expire after 2 hours; the script handles automatic refresh ### 6. Security Best Practices

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If companion code authenticates, validates credentials, or prints token fragments while the skill is described only as a content reader, that is a meaningful security mismatch because it introduces secret-handling behavior not clearly disclosed to users. Undocumented token handling increases the chance of accidental exposure in logs, transcripts, or debugging output.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
- **Secure credential storage**: Supports both environment variables and secure file storage - **No credential logging**: Credentials never appear in logs or output - **Minimal permissions**: Uses only required API permissions - **Access token caching**: Efficient token reuse to minimize API calls ## Command Line Options

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · CONTRIBUTING.md (reported line 26)May include surrounding context.
bash
cp reference/feishu_config_sample.json reference/feishu_config.json chmod 600 reference/feishu_config.json

编辑 reference/feishu_config.json，填入你的 app_id 和 app_secret。

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 33)May include surrounding context.
bash
cp reference/feishu_config_sample.json reference/feishu_config.json chmod 600 reference/feishu_config.json

编辑 reference/feishu_config.json，填入你的 app_id 和 app_secret。

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
bash
cp reference/feishu_config_sample.json reference/feishu_config.json chmod 600 reference/feishu_config.json

编辑 reference/feishu_config.json，填入你的 app_id 和 app_secret。

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · INTEGRATION.md (reported line 99)May include surrounding context.
md
### 6. Security Best Practices - Never log or expose app secrets - Use file permissions (`chmod 600`) on config files - Validate document tokens before processing - Implement proper error handling to avoid information leakage

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 300)May include surrounding context.
md
### 6. Security Best Practices - Never log or expose app secrets - Use file permissions (`chmod 600`) on config files - Validate document tokens before processing - Implement proper error handling to avoid information leakage

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 161)May include surrounding context.
md
### 6. Security Best Practices - Never log or expose app secrets - Use file permissions (`chmod 600`) on config files - Validate document tokens before processing - Implement proper error handling to avoid information leakage

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README promotes reading Feishu documents, spreadsheets, bitables, and wiki content and even highlights AI-agent integration, but it does not clearly warn users that the tool may retrieve and print sensitive business data to stdout or downstream systems. In agent or pipeline contexts, this omission increases the chance of accidental data exposure through logs, chat transcripts, or untrusted tool consumers.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool scope even though the documented behavior clearly requires network access, filesystem reads, and likely environment/config access for credentials. In an agent environment, missing scope declarations can cause overbroad execution or prevent users and policy engines from understanding that the skill can access local secrets and exfiltrate document data over the network.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · USAGE_EXAMPLES.md (reported line 180)May include surrounding context.
手动测试API

bash
# 获取tenant_access_token curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{"app_id":"your_app_id","app_secret":"your_app_secret"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script’s docstrings, CLI descriptions, help text, logs, and error messages are all written in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This matches the language/locale policy violation category because the skill does not offer a language choice or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description says it reads Feishu documents, but this code also supports enumerating an entire Wiki space and, when recursive mode is enabled, extracting content from many child nodes automatically. That materially expands the data-access scope from a single requested document to potentially large collections of sensitive documents, increasing the risk of unintended bulk disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The recursive Wiki-space read path can retrieve and output large amounts of content without any user-facing warning about scope, sensitivity, or volume. In a document-reader skill, this makes accidental over-collection and disclosure of confidential enterprise knowledge more likely, especially when output is serialized as JSON for downstream handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This shell script presents usage, warnings, and error messages exclusively in Chinese, which imposes a specific language on users without opt-in. That matches the language/locale policy violation category because the file does not indicate that the skill is intentionally region-specific or provide an alternative language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file contains user-facing and descriptive text in Chinese, including the module docstring and function docstrings, with no indication that the skill is intentionally limited to Chinese-speaking users. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in or clearly documents and justifies the locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This shell script requires app_id and app_secret in a configuration file, then invokes Python readers to access Feishu documents. Although usage is documented, there is no explicit disclosure that running the script will use stored credentials and perform remote API access that may retrieve potentially sensitive document data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Undeclared Tool Scope

External Transmission

手动测试API

Natural-Language Policy Violations

Description-Behavior Mismatch

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Static analysis