Feishu Meeting Assistant

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:12 PM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it automatically reads meeting-linked Feishu documents and sends derived content while exposing document identifiers and rendering untrusted Markdown without safeguards.

Review this before installing if your Feishu calendar or linked documents may contain confidential material. It should ideally add explicit consent or confirmation, avoid logging or sending raw document tokens, and sanitize or plain-text render calendar and document content in briefing cards.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: check.js:37
• Finding: Sensitive Feishu identifiers exposed in logs and failure briefings<![CDATA[ ## Vulnerability Details **File Location**: `check.js`, lines 37–43 and 105 **Vulnerability Type**: Sensitive identifier exposure through logging and outbound messages **Risk Level**: Medium ### Vulnerable Code ```js console.log(` Fetching doc: ${link.token}`); const docData = await readDoc(link.token); const preview = extractPreview(docData.content); summaries.push(`📄 **${docData.title || 'Untitled'}**\n${preview}`); } catch (e) { console.error(` Failed to read doc ${link.token}: ${e.message}`); summaries.push(`❌ Failed to load doc: ${link.token}`); } ``` The configured recipient identifier is also logged: ```js console.log(`Sending briefing to ${target}...`); ``` ### Technical Analysis The implementation writes complete Feishu document tokens to standard output during normal operation and error output when document retrieval fails. On failure, it additionally incorporates the complete token into the briefing card transmitted to the configured recipient. The value of `FEISHU_MASTER_ID`, which may represent an Open ID or chat ID, is also written to logs. These identifiers are not necessarily standalone authentication credentials, but they identify protected Feishu resources and can facilitate access when combined with a valid, compromised, or overly privileged Feishu account. Full identifiers are unnecessary for operational logging and exceed the minimum information required to report progress or failure. The pre-scan finding at line 37 does not directly transmit the token over the network; it exposes it through process output. Network disclosure can occur at line 43 because the failure message becomes part of the briefing sent through the Feishu API. ### Attack Path 1. The Skill scans an event description containing a Feishu document link. 2. The extracted document token is printed to standard output. 3. If document retrieval fails, the token is printed to error output and added to the briefing content. 4. Runtime logs are collect ...[truncated 1084 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not log complete document tokens, Open IDs, or chat IDs. - Replace token-bearing progress messages with non-sensitive context, such as document type or sequence number: ```js console.log(` Fetching ${link.type} document`); ``` - Return a generic failure message in the briefing: ```js console.error(` Failed to read ${link.type} document: ${e.message}`); summaries.push('❌ Failed to load an attached document.'); ``` - If correlation is operationally required, use a non-reversible internal request ID. As a weaker alternative, redact all but a short suffix and ensure logs have restricted access and short retention. - Avoid logging `FEISHU_MASTER_ID`; log only whether the destination was resolved as a direct recipient or chat. - Review existing logs and delivered failure cards for exposed identifiers, then remove them where retention systems permit. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: check.js:39
• Finding: Untrusted calendar and document content rendered as interactive Markdown<![CDATA[ ## Vulnerability Details **File Location**: `check.js`, lines 39–40 and 88 **Vulnerability Type**: Unescaped content injection into a trusted briefing card **Risk Level**: Medium ### Vulnerable Code Document titles and previews are placed into Markdown-formatted strings without escaping: ```js const preview = extractPreview(docData.content); summaries.push(`📄 **${docData.title || 'Untitled'}**\n${preview}`); ``` The event summary and generated document strings are then inserted into a `lark_md` element: ```js content: `**${event.summary}**\n🕒 ${timeStr}\n\n${docSummaries.join('\n\n')}` ``` ### Technical Analysis The event summary, document title, and first 300 characters of document content originate from Feishu resources that may be editable by meeting organizers, collaborators, or other external users. These values are interpolated directly into a Feishu `lark_md` field. Because Markdown control characters and constructs are not escaped or sanitized, an attacker who can modify a scanned event or linked document can alter how the trusted briefing card is rendered. Crafted content may introduce deceptive formatting, attacker-controlled links, misleading instructions, or content that visually resembles trusted card elements. The 300-character preview limit reduces payload size but does not prevent injection because a functional Markdown payload can fit within that limit. This is a presentation-layer injection issue; the audited code does not execute the document content as JavaScript or a system command. ### Attack Path 1. An attacker obtains permission to create or edit an event on the scanned `Master` calendar, or to edit a Feishu document linked from an upcoming event. 2. The attacker places crafted Markdown in the event summary, document title, or beginning of the document. 3. The event falls within the configured 24-hour scanning window. 4. The Skill reads the attacker-controlled value and interpolates it into a `lark_md` card without ...[truncated 788 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Escape all untrusted values before inserting them into `lark_md`, including event summaries, document titles, previews, and error text. - Use Feishu plain-text elements where Markdown functionality is not required. - If Markdown must be retained, implement an allowlist-based sanitizer that neutralizes links and unsupported formatting constructs rather than relying only on character replacement. - Treat document content as quoted external material and visually delimit it from trusted card labels. - Apply independent length limits to event summaries, titles, and previews to prevent oversized or confusing cards. - Consider removing active links from extracted content and adding only application-generated links whose destinations have been validated. - Add tests containing Markdown links, formatting delimiters, malformed syntax, and multiline content to verify that user-controlled text cannot alter the intended card structure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description states that it scans calendar events, reads attached Feishu documents, and sends a summarized briefing card, but it does not clearly warn users that potentially sensitive document contents will be automatically accessed and retransmitted. This creates a transparency and consent problem: users may invoke the skill without realizing it processes confidential meeting materials and redistributes derived content to another channel.