Security audit

Feishu Literature Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Feishu literature-management purpose, but it should be reviewed because it automatically uses high-impact Feishu permission management and persistent tool configuration.

Install only if you expect the skill to create or modify Feishu Bitables and you are comfortable with it reading existing table records for deduplication. Before use, confirm any full_access permission grant and avoid enabling the Feishu permission-management tool globally unless you need that capability.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This code chunk is a narrow utility module for parsing PubMed XML and formatting references. While that is related to the broader literature-management description, it implements only a small supporting subset of the declared functionality. The declared purpose emphasizes an automated end-to-end workflow involving PubMed searching, Feishu table management, database creation/supplementation, and enrichment fields like translations and impact factors. None of those core operational capabilities appear in this code. There is no evidence of network calls to PubMed, no Feishu API usage, no table creation/update logic, and no translation or journal metric handling. Therefore the description materially overstates what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a comprehensive workflow spanning PubMed search plus Feishu table creation/management and metadata enrichment. The supplied code chunk is much narrower: it only queries NCBI E-utilities to search PubMed, fetch XML details, and check PMC linkage. The PubMed search portion is aligned, but the majority of the declared functionality is absent, especially all Feishu-related behavior and enrichment features. Additionally, the code includes PMC availability checking, which is not mentioned in the description. Therefore the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes direct network access to PubMed via curl/E-utilities and external resource lookups, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. Undeclared network capability weakens policy enforcement and reviewability, making it easier for a skill to exfiltrate data or perform unexpected external requests without clear operator approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow says to set table permissions to full_access automatically, with no explicit consent or warning before changing access controls. Silent privilege changes are dangerous because users may not realize the skill is altering who can manage, share, or delete the table, and this can create unauthorized exposure or loss of control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The supplementation workflow instructs listing existing records and extracting PMIDs from the user’s Feishu table without a clear notice that table contents will be read. Accessing existing records may expose data beyond what the user expects for a simple add-papers request, especially if the table contains notes, annotations, or other sensitive research metadata.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs granting full_access on the Feishu table, which includes permission management and deletion rights beyond what is necessary to populate a literature database. Excessive privileges increase the blast radius if the skill is misused, compromised, or applied to the wrong principal, enabling destructive or administrative changes unrelated to the user’s immediate request.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs enabling a permission-management tool and extracting the user’s open_id from inbound metadata to modify access controls. This expands the skill from literature management into identity and authorization administration, creating risk of unauthorized sharing, privilege assignment, or misuse of identity metadata.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes natural-language requirements such as 'Use Chinese title' and 'Must translate from English,' which impose a specific language output. Under the policy rule, forcing a locale or language without opt-in or documented justification is a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The line requires the Chinese abstract to be translated and structured in Chinese-specific labels. Because the file does not explain that this is a justified region-specific requirement or offer a language choice, it conflicts with the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The 'Always translate title and abstract' instruction is a blanket language requirement. In the absence of an explicit regional/compliance justification or user opt-in, this is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown content includes Chinese-only labels such as "医学1区", "中文核心期刊", and "新刊待评估" alongside English text, but it does not explain that the file is intended for a Chinese-locale workflow or offer an alternative for users who do not read Chinese. That can create a language/locale policy issue because the skill content effectively assumes a specific locale without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The function is explicitly documented as formatting references in "GB/T 7714-2015 format," which is a locale-specific/national standard. The file does not indicate that this format is optional, user-selected, or justified as part of a region-specific tool, so it can be read as enforcing a specific locale convention by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.