Security audit

科技新闻日报

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent as a Feishu tech-news reporting workflow, but it embeds a Feishu app secret and automatically grants or sends document access to fixed Feishu accounts.

Review before installing. Only use this skill if you control the exact Feishu app, wiki space, OpenID, and chat ID shown in the artifact. Rotate the exposed app secret, replace it with a protected runtime secret, make the recipient and chat destination configurable, and require confirmation before creating documents, overwriting content, granting permissions, or sending links.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:98
Finding: Hard-Coded Feishu Application Secret Enables Unauthorized API Authentication
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:98
Finding: Automatic Full-Access Grant to a Hard-Coded Feishu Account
Content: View full analysis
", "member_id": "ou_d8ace8a146610ca26bc07d8e68a5620f", "member_type": "openid", "perm": "full_access" }' ``` ### Technical Analysis The Skill directs the agent to grant `full_access` to a fixed Feishu OpenID for each generated report. This principal is not selected by the invoking user, and the workflow does not request confirmation before changing the document's access-control list. Creating, populating, and delivering a news report does not inherently require granting a hard-coded account full control. Read-only access would normally be sufficient for a recipient, while ownership or editing rights should be assigned only to an explicitly configured user. The instruction also obtains a tenant token and directly invokes the permissions API, bypassing any interactive checks that might otherwise make the permission change visible to the operator. This breaks the principle of least privilege. ### Attack Path 1. A user or agent invokes the Skill to generate a daily report. 2. The Skill creates a Feishu wiki node and document. 3. It obtains a tenant access token using the configured application credentials. 4. It invokes the Feishu Drive permissions endpoint for the newly created document. 5. The fixed OpenID `ou_ ...[truncated 793 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:305
Finding: Mandatory Disclosure of Report Links and Local Path Metadata to a Hard-Coded Group
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback path combines credentialed Open API calls, document creation, content upload, and permission grants without any explicit privacy/security warning. Because it bypasses interactive tooling safeguards and directly uses API credentials, misuse or accidental execution can have broad tenant impact.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: This pattern is effectively a credentialed external fetch/authentication flow using curl, paired with a hardcoded app_secret. In context, it enables direct token acquisition outside safer abstractions, making secret theft and downstream API abuse substantially more likely.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
--content @memory/YYYY-MM-DD-tech-news.xml # 步骤 3：授予张公子 full_access 权限（用 Open API 直接调，绕过 lark-cli 交互限制） ACCESS_TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill documentation embeds a live Feishu app_secret and explicitly instructs using it to mint tenant access tokens. Hardcoded secrets in skill content can be exfiltrated by anyone with access to the file and then abused to access or modify Feishu resources tied to the tenant.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 95% confidence
Finding: This curl-based direct API invocation alters document permissions using the acquired bearer token, bypassing safer interactive or policy-enforced tooling. In context, the combination of direct scripting plus privilege grant makes accidental or unauthorized access expansion more dangerous.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
-d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest claims the skill now reads hot news 'from AIHOT single site,' implying a direct-source workflow. However, the implementation instructions specify using the Tavily extraction tool against the AIHOT page, which is materially different from directly reading the site and contradicts the declared simplification away from intermediary search/extraction tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill performs external side effects including local file writes, Feishu document overwrite/creation, permission changes, and message sending without an explicit warning or confirmation boundary. In agent environments, undocumented side effects increase the chance of unintended data modification or transmission.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented workflow grants a specific user full_access on generated Feishu documents, which exceeds the stated need of publishing a daily report link. Unnecessary privilege grants create an access-control risk and can expose, alter, or re-share documents beyond the intended audience.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This line sends credentials to Feishu to obtain a tenant access token, enabling authenticated access to external systems. In context, the risk is elevated because the request uses a hardcoded secret embedded in the skill, turning ordinary transmission into credential exposure and potential tenant compromise.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
--content @memory/YYYY-MM-DD-tech-news.xml # 步骤 3：授予张公子 full_access 权限（用 Open API 直接调，绕过 lark-cli 交互限制） ACCESS_TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This external API call modifies Feishu document permissions by granting full_access to a specific member. External transmission that changes access control is security-sensitive and can directly expose or delegate control over generated documents.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
-d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 78% confidence
Finding: Creating a Feishu wiki node is an external transmission with write side effects, but by itself it is aligned with the skill's stated purpose and is not inherently malicious. It is still security-relevant because it writes to an external system and should be disclosed and authorized.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
| python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") # 2. 在知识库「科技新闻日报」节点下创建 wiki 节点 curl -s -X POST 'https://open.feishu.cn/open-apis/wiki/v2/spaces/7621391289904516315/nodes' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{"parent_node_token": "Iv9UwDW5viSJDWk12j7cBazYn8b", "node_type": "origin", "obj_type": "docx", "title": "科技新闻日报 | YYYY年MM月DD日"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Uploading document content to Feishu is an external write operation consistent with the skill's purpose, but it still transmits potentially sensitive compiled content to an external platform. The risk depends on content sensitivity and whether the user expected this transmission.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
# → 获得 obj_token # 3. 写入文档内容（batch create blocks，XML 格式） curl -s -X POST 'https://open.feishu.cn/open-apis/docx/v1/documents/<obj_token>/blocks/<root_block_id>/children' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{"children": [...]}'

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description mandates a Chinese daily report format ('每日AI/科技热榜日报') and the document/message templates throughout the file are fixed in Chinese. There is no indication that the user can opt into another language or locale, which is a natural-language locale policy concern under the rule.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Earlier workflow instructions explicitly define the time window as the past 3 days, while the later '注意事项' section says only current-day news should be included. These directives conflict and create an intent-code/documentation divergence about the actual collection scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The main Feishu sync workflow instructs granting access after document creation via the permissions API, but the later notes say the document must be created with owner_open_id to ensure edit access. These are conflicting operational instructions for how access should be established.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language instructions and examples are presented only in Chinese, which can amount to forcing a specific language without user opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes examples for creating a document and writing content to an existing document, which are user-data modifying operations. The description does not include any warning about creating or overwriting content, choosing the correct destination, or verifying tokens before execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.