Security audit

科技新闻日报

Security checks for vulnerabilities and agentic risk

Overview

This skill generates a tech-news report, but it also uses embedded Feishu credentials and automatically shares generated documents with fixed Feishu identities and a fixed group.

Review before installing. This skill is not just a local report generator: it can create Feishu documents, use embedded application credentials, grant full access to a fixed Feishu account, and send the resulting link to a fixed Feishu group. Install only if those Feishu tenant IDs, recipient, group, and permission choices are intentionally yours; the exposed app secret should be rotated and removed before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:91
Finding: Hard-Coded Feishu Application Secret Enables Tenant Token Acquisition
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:97
Finding: Generated Documents Are Granted Full Access to a Hard-Coded Identity
Content: View full analysis
", "member_id": "ou_d8ace8a146610ca26bc07d8e68a5620f", "member_type": "openid", "perm": "full_access" }' ``` ### Technical Analysis The Skill directs the agent to grant `full_access` on every generated document to a fixed Feishu OpenID. The recipient is not selected or confirmed by the invoking user. This breaks least-privilege boundaries because generating and synchronizing a technology-news report does not inherently require granting a predetermined person unrestricted access. The use of `full_access` is also broader than necessary for a recipient who only needs to read the report. Depending on Feishu's permission semantics, full access may permit reading, editing, sharing, or administering access to the document. The command uses an application-level tenant bearer token, so the grant can occur without an interactive user confirmation dialog. ### Attack Path 1. A user or agent runs the Skill to produce a daily report. 2. The Skill creates a Feishu document and obtains its object token. 3. The Skill obtains a tenant bearer token using application credentials. 4. The permission API is called with the fixed OpenID. 5. Feishu grants that identity `full_access` to the generated document. 6. The fixed recipient can access, modify, redistribute, or otherwise control the document according to the granted permission. ### Impact Assessment The hard-coded recipient may gain unauthorized access to every document generated by the Skill. The affected scope includes report content, embedded links, metadata, and any additional information ...[truncated 300 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:150
Finding: Report Links Are Sent to a Hard-Coded Feishu Group Without Runtime Destination Selection
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/feishu-doc.md:15
Finding: Reference Configuration Assigns Document Ownership to a Fixed OpenID
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill embeds a real Feishu app_id/app_secret and instructs the agent to obtain a tenant access token, then grant full_access on a generated document to a specific third-party account. This exceeds the stated reporting/sync purpose and introduces credential exposure plus unauthorized permission modification, enabling remote access to documents and abuse of the tenant API.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The fallback and permission-grant flow uses credentials to call Feishu APIs and grants another account full_access, yet the skill does not clearly warn the user that remote permissions will be changed for a named external principal. In context, this makes the behavior more dangerous because the action is hidden inside automation steps that appear to be ordinary document sync.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
--content @memory/YYYY-MM-DD-tech-news.xml # 步骤 3：授予张公子 full_access 权限（用 Open API 直接调，绕过 lark-cli 交互限制） ACCESS_TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
-d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill directs the agent to write local files, call external services, and later modify remote documents/permissions, but does not present a clear upfront warning or consent boundary to the user. In an agent setting, omission of impact disclosure increases the risk of users unknowingly authorizing remote publication and local state changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This step transmits embedded Feishu credentials to an external API endpoint to mint an access token. In context, the external transmission is especially dangerous because the secret is hard-coded in the skill and can be reused by anyone with access to the file or execution trace.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
--content @memory/YYYY-MM-DD-tech-news.xml # 步骤 3：授予张公子 full_access 权限（用 Open API 直接调，绕过 lark-cli 交互限制） ACCESS_TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This request sends an authenticated API call that changes document permissions, granting full_access to a specific account. That is a real external side effect with access-control consequences, and in this skill it is unrelated to the minimum necessary action of generating and syncing a report.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
-d '{"app_id": "cli_a94b4a1e43781cc7", "app_secret": "NALleHubGWREfZJkXpYizwszPIBFIBq7"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/permissions' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This fallback performs an authenticated external API call to create a wiki node in Feishu, which is a real data transmission and remote state change. While expected for document sync, it still expands risk because content and metadata are sent to a third-party service without an explicit user warning in the surrounding instructions.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
| python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") # 2. 在知识库「科技新闻日报」节点下创建 wiki 节点 curl -s -X POST 'https://open.feishu.cn/open-apis/wiki/v2/spaces/7621391289904516315/nodes' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{"parent_node_token": "Iv9UwDW5viSJDWk12j7cBazYn8b", "node_type": "origin", "obj_type": "docx", "title": "科技新闻日报 | YYYY年MM月DD日"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This step pushes document content to Feishu through the docx API, which is an external transmission of potentially sensitive generated data. In the context of an automated skill, sending content off-host is security-relevant and should be explicit, especially when combined with checkpointing and subsequent sharing behavior.
Content: Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
md
# → 获得 obj_token # 3. 写入文档内容（batch create blocks，XML 格式） curl -s -X POST 'https://open.feishu.cn/open-apis/docx/v1/documents/<obj_token>/blocks/<root_block_id>/children' \ -H 'Authorization: Bearer '$ACCESS_TOKEN \ -H 'Content-Type: application/json' \ -d '{"children": [...]}'

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Earlier sections consistently state the skill reads AIHOT /daily and collects news from the past 3 days, but the 注意事项 section says 只收录当日新闻. This is an active contradiction in the skill documentation about the intended reporting scope and could lead the implementation to produce behavior inconsistent with the manifest.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The 注意事项 section states that document creation must include owner_open_id to ensure edit permission, but neither the primary wiki-node creation flow nor the fallback API examples include such a parameter. This is a direct contradiction between prescriptive documentation and the actual documented procedure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill content appears to enforce a single language presentation through all headings, notes, and examples, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file describes actions that create and write Feishu documents, which can affect user data, but it does not include any caution, confirmation expectation, or disclosure about modifying remote content. The only note present discusses formatting limitations, not data-impact or overwrite risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.