Feishu Calendar Advanced

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:34 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Feishu calendar helper, but it asks users to run an unpinned external CLI that handles secrets and can delete calendar events without enough safety guidance.

Install only if you trust the @teamclaw/feishu-agent package source and are comfortable granting it Feishu calendar access. Prefer pinned package versions, avoid entering real app secrets directly in shell commands, rotate any secret already exposed in history, and verify event IDs before deletion.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26
• Finding: Unpinned Third-Party Package Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26–42 **Vulnerability Type**: Supply-chain exposure caused by dynamic execution of an unpinned dependency **Risk Level**: High ### Vulnerable Code ```bash # Interactive setup wizard (recommended) bunx @teamclaw/feishu-agent setup # Or manual configuration bunx @teamclaw/feishu-agent config set appId <your_app_id> bunx @teamclaw/feishu-agent config set appSecret <your_app_secret> ``` ```bash bunx @teamclaw/feishu-agent auth ``` ```bash bunx @teamclaw/feishu-agent whoami ``` ### Technical Analysis The Skill instructs users to execute `@teamclaw/feishu-agent` through `bunx` without specifying an exact, audited package version. In the absence of a committed lockfile or integrity verification, `bunx` may retrieve the package version currently resolved by the package registry when each command is run. Consequently, the code executed at runtime can differ from the code reviewed during this audit. A compromised package release, package-maintainer account, or registry distribution path could introduce arbitrary code. This concern is amplified because the package is used to configure a Feishu application secret, conduct OAuth authorization, and access calendar functionality. The repository contains only `SKILL.md`; it does not include the dependency's implementation or an integrity manifest. Therefore, the actual behavior of the downloaded package and the claimed conflict-detection functionality cannot be independently verified from this project. ### Attack Path 1. An attacker compromises the package maintainer's publishing credentials, package distribution channel, or a future release of `@teamclaw/feishu-agent`. 2. The attacker publishes a modified package version containing malicious installation or runtime behavior. 3. A user follows the Skill documentation and runs an unversioned `bunx @teamclaw/feishu-agent ...` command. 4. `bunx` resolves, downloads, and executes the attacker-control ...[truncated 727 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@teamclaw/feishu-agent` to an exact, reviewed version in every command, rather than relying on registry resolution of an unspecified version. 2. Maintain a committed lockfile and use an installation mode that refuses unexpected dependency changes. 3. Verify package integrity through trusted checksums or package-manager integrity metadata before execution. 4. Document the package's authoritative source repository and validate the publisher and release provenance. 5. Prefer a vendored or locally installed implementation that has been reviewed before use, especially for commands that handle credentials and OAuth tokens. 6. Run the package with the minimum required operating-system and Feishu permissions. 7. Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version is changed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Feishu Application Secret Is Passed as a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–30 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash bunx @teamclaw/feishu-agent config set appId <your_app_id> bunx @teamclaw/feishu-agent config set appSecret <your_app_secret> ``` ### Technical Analysis The documented manual configuration procedure places the Feishu application secret directly in a command-line argument. Depending on the operating system, shell, terminal environment, and monitoring configuration, command arguments may be exposed through: - Shell history files - Process inspection utilities - Process accounting or endpoint monitoring - Terminal transcripts and session recording - Debug logs, support bundles, or copied command output The placeholder itself is not a hardcoded secret. The vulnerability arises when a user replaces it with a real secret as instructed. Command-line arguments are generally unsuitable for long-lived credentials because they may persist outside the intended credential store even after the command finishes. ### Attack Path 1. A user replaces `<your_app_secret>` with a valid Feishu application secret and executes the documented command. 2. The shell records the full command in history, or local process-monitoring software captures its arguments while it is running. 3. A local user, administrator, support operator, malware process, or party with access to collected logs retrieves the exposed argument. 4. The attacker combines the secret with the corresponding application ID. 5. The attacker authenticates as the Feishu application or otherwise abuses the credentials within the permissions assigned to that application. ### Impact Assessment Exposure may allow an attacker to impersonate the configured Feishu application within the scope of its granted permissions. Based on the documented use, affected access may include calendar and event opera ...[truncated 283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not accept application secrets as command-line arguments. 2. Provide a hidden interactive prompt that disables terminal echo and avoids retaining the secret in shell history. 3. Alternatively, integrate with an operating-system credential manager or an approved secrets-management service. 4. If a configuration file is necessary, store the secret in a dedicated file with restrictive owner-only permissions and clearly document its location and protection requirements. 5. Avoid logging secret values, and redact credentials from diagnostics, crash reports, and support bundles. 6. Document credential rotation procedures so users can promptly revoke and replace a secret if command history or telemetry may have captured it. 7. Recommend reviewing and clearing any existing shell-history or session records containing real secrets, followed by rotating the exposed credential. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup instructions tell users to store an app ID and app secret via CLI configuration without any warning that the app secret is sensitive credential material. This can lead to insecure handling, such as entering secrets in shared shells, storing them in plaintext config files, or exposing them through logs or command history.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents a delete operation that can remove calendar events by ID, but it provides no warning, confirmation step, or safety guidance before performing a destructive action. In an agent context, this increases the risk of accidental or unintended deletion of user data, especially if the command is invoked from ambiguous prompts or with the wrong event ID.

Static analysis

No suspicious patterns detected.