T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/install.py:110- Finding
Persistent Full-Access Automation Installed Through Direct Database Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
邮件雷达 MailRadar
Security checks for vulnerabilities and agentic risk
Overview
The skill does build a Feishu email dashboard, but it should be reviewed because it installs persistent full-access automation and moves email-derived content into files, LLM translation, HTML, and Feishu messages.
Review before installing. Use --no-automation first, run --no-push for local preview, verify the Feishu open_id, and avoid using this on sensitive mailboxes unless you are comfortable with local email-derived files, LLM translation handling, and Feishu card/HTML delivery. Do not enable the default daily automation unless full-access persistent WorkBuddy automation is acceptable in your environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_dashboard3.py:310- Finding
Stored Script Injection Through Unsafe JSON Embedding in the Generated Dashboard
- Content
View full analysis
const DATA = __DATA__; const CN = __CN__; const CN_TODO = __CN_TODO__; const CN_IBERIA = __CN_IBERIA__; const PALETTE=['#3E6E9E','#3E8E80','#B5791F','#8A7CA8','#6B8CA5','#C2A35A']; function esc(s){return (s==null?'':String(s)).replace(/[&<>]/g,function(c){return {'&':'&','<':'<','>':'>'}[c];});} ``` ```python html = (HTML .replace('__DATA__', json.dumps(aug, ensure_ascii=False)) .replace('__CN__', json.dumps(CN_STORES, ensure_ascii=False)) .replace('__CN_TODO__', json.dumps(CN_TODOS, ensure_ascii=False)) .replace('__CN_IBERIA__', json.dumps(CN_IBERIA, ensure_ascii=False)) .replace('__WIN__', aug['window']['start'] + ' ~ ' + aug['window']['end']) .replace('__GEN__', aug['generated_at']) ``` ### Technical Analysis Mailbox-derived data and LLM-generated translation data are serialized with `json.dumps` and inserted directly into an executable `` can terminate the script element even when it occurs inside a valid JavaScript string. Content following the closing tag is then interpreted as HTML and can introduce a new executable script element. The vulnerable data includes externally influenced email subjects and body excerpts, as well as translation fields imported from JSON. The generated file is subsequently sent as a Feishu attachment, making this a stored injection issue delivered to the configured recipient. ### Attack Path 1. An attacker sends an email whose subject or relevant body contains a payload such as: ```html ``` 2. `daily_mail_board.py` retrieves the message through `lark-cli`. ...[truncated 1261 chars]- Remediation
View remediation
` as `\u003e` - `&` as `\u0026` - U+2028 as `\u2028` - U+2029 as `\u2029` 3. Prefer a non-executable data container: ```html ``` Ensure the serialized content is HTML-safe before insertion, then parse it with `JSON.parse(document.getElementById('dashboard-data').textContent)`. 4. Alternatively, load a separately generated JSON file under a deployment model with appropriate origin and access controls. 5. Add a restrictive Content Security Policy that disallows inline scripts and limits outbound connections, for example with `script-src 'self'` and `connect-src 'none'` where practical. 6. Add regression tests using payloads containing ``, quotes, Unicode separators, event handlers, and nested HTML. 7. Treat both email data and imported LLM translation data as untrusted through the entire rendering pipeline. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_dashboard3.py:813- Finding
Attribute and Inline Event-Handler Injection in Dynamic Dashboard Markup
- Content
View full analysis
]/g,function(c){return {'&':'&','<':'<','>':'>'}[c];});} ``` ```javascript function row(i){ var proj=''+esc(i.proj||i.src||'')+''; var summary=reminderSummary(i); var rid=i.target; return ''+ ''+esc(i.date)+''+ ''+proj+''+ ''+esc(summary)+''+ ''+ '✓ 已回复'+ '跳转 →'+ ''+ ''; } ``` ### Technical Analysis The `esc()` function only encodes ampersands and angle brackets. It does not encode double quotes or single quotes. This function is nevertheless used inside the double-quoted `title` attribute. An attacker-controlled subject containing a double quote can terminate the attribute and introduce additional attributes. Separately, routing identifiers such as `i.target`, `rid`, and related values are interpolated into single-quoted JavaScript string literals inside inline `onclick` handlers without JavaScript-string escaping. HTML text, HTML attribute values, and JavaScript string literals are distinct parsing contexts and require different encoding rules. A single partial HTML-text escape function is not safe across those contexts. ### Attack Path 1. An attacker supplies crafted mailbox metadata, such as a subject containing a quotation mark followed by an event-handler attribute. 2. The message is retrieved and included in reminder data. 3. `row(i)` con ...[truncated 919 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/install.py:121- Finding
Untrusted Email Content Is Passed to a Full-Access Translation Agent Without Prompt-Injection Isolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a full end-user workflow: collecting recent Feishu emails, extracting multiple categories of business intelligence, generating translated/tiered summaries, producing an HTML dashboard, and pushing daily Feishu cards automatically. The supplied code chunk is a much narrower preprocessing script. Its purpose is to condense an already-prepared JSON inbox dataset into a smaller JSON containing selected threads for four stores using simple deadline/recent-activity filters. This is likely a supporting component in a larger pipeline, but by itself it does not implement the core declared functionality. The biggest discrepancies are the absence of Feishu access, absence of dashboard/card/HTML generation, absence of automation, and the 14-day local filtering behavior versus the promised 7-day mailbox summarization.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description claims a complete end-to-end mail-board workflow: collecting recent Feishu emails, extracting store/business/delivery signals, producing Chinese summaries and deadline alerts, generating an HTML board, and automatically pushing daily Feishu cards. The actual code chunk is much narrower. It reads existing JSON files (cn_inbox.json / cn_inbox_full.json), prints compact thread content for LLM translation, validates translated entries with fields like summary/todos/risk, merges them into workboard2_cn.json, and shows counts. This translation-layer helper is related to one small described feature (Chinese summary translation), but it does not implement the skill’s primary declared behavior. Therefore the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
该代码与声明有明显相关性：它确实围绕邮件整理看板数据，覆盖重点门店（科隆/罗马/杜塞/苏黎世）、西葡非建店业务，以及下单/交付/交期待办，并抽取进展、待办和DDL，属于“邮件看板”的后端数据整理部分。但声明描述的是一个完整技能：生成HTML看板、提供临期三档提醒、中文翻译、已回复按钮、飞书卡片推送以及自动化部署。实际代码只完成离线的数据提取与汇总，输出为JSON，没有任何飞书API调用、卡片推送、HTML生成、翻译、按钮交互或自动化注册实现。此外，声明强调“近7天邮件”，而代码最终输出窗口起始时间硬编码为2026-07-01，并未在此片段中体现7天筛选。因此，虽然主题方向一致，但声明显著高于代码实际能力，存在实质性描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a complete end-user workflow: collecting recent Feishu email, building a dashboard, translating/summarizing, generating reminder tiers, producing self-contained HTML, and automatically pushing daily Feishu cards. The supplied code chunk is much narrower: it preprocesses existing JSON data into cn_inbox_full.json by selecting threads/items, stripping quoted text, and packaging fields for later LLM translation. While this supports part of the stated pipeline (preparing data for Chinese summarization of store/Iberia/todo emails), it does not itself implement the main advertised outputs or automations. Therefore the description materially overstates what this code chunk actually does.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `gen_dashboard3.py` 的 `trSubj` 中文翻译表、`extract4.py` 的 `classify_store` 即可。
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The script reads sensitive identifiers and mailbox settings from environment variables and config, then uses them to pull email content and push summaries/attachments to a chat recipient. In a skill context, undeclared environment/config access is dangerous because it can silently consume secrets or redirect data to an unintended recipient without an explicit permission boundary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file states '全部中文', which forces a specific language for generated output. Under the policy, locale or language constraints should either be optional for the user or clearly justified as a region-specific requirement; this file does not provide such opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The deployment guide instructs users to configure a Feishu
open_idand states that cards and @ reminders will be sent to that account, but it does not clearly warn that email-derived content and account identifiers will be transmitted to an external platform. Because this skill summarizes recent mailbox content and pushes it out automatically, users may expose internal or sensitive business information without informed consent or data-handling review.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The optional translation workflow tells users to hand generated content to an LLM for translation without warning that the exported
cn_inbox.jsonis derived from mailbox data and may contain sensitive business communications. Sending such content to an external LLM service can create confidentiality, compliance, and retention risks, especially because the skill processes recent emails and business status items.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The --apply path merges user-provided translation data into an existing JSON file and then writes the result to workboard2_cn.json. Although the module docstring describes the data flow, the code path performs a persistent file write without a confirmation prompt or explicit user-facing warning that existing entries may be updated.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 93% confidence
- Finding
This wrapper invokes
bash -lcto execute a constructed command string, which expands the attack surface beyond a directsubprocess.run([...])call. Although each argument is shell-quoted, the effective executable is resolved through the shell and environment, andBASH_EXEitself is discovered from the user-controlled home directory, so a trojaned bash or manipulated runtime environment could cause arbitrary command execution while processing mailbox data.- Content
python def lark(args, timeout=120): cmd = "lark-cli " + " ".join(shlex.quote(a) for a in args) r = subprocess.run([BASH_EXE, "-lc", cmd], capture_output=True, text=True, cwd=WS, timeout=timeout) if r.returncode != 0: raise RuntimeError("lark-cli failed [%s]: %s" % (" ".join(args[:3]), r.stderr.strip()[:300])) return r.stdout
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # ---------------- generate + send ---------------- def generate(): print("[3/5] extract4 -> workboard2_data.json") subprocess.run([sys.executable, "extract4.py"], cwd=WS, check=True) print("[4/5] gen_dashboard3 -> mail_workboard2.html") subprocess.run([sys.executable, "gen_dashboard3.py"], cwd=WS, check=True) # 生成待翻译清单（供 agent 在自动化里做 LLM 中文翻译/归纳）
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("[3/5] extract4 -> workboard2_data.json") subprocess.run([sys.executable, "extract4.py"], cwd=WS, check=True) print("[4/5] gen_dashboard3 -> mail_workboard2.html") subprocess.run([sys.executable, "gen_dashboard3.py"], cwd=WS, check=True) # 生成待翻译清单（供 agent 在自动化里做 LLM 中文翻译/归纳） if os.path.exists("prep_cn.py"): try:
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The pipeline intentionally condenses email bodies into translated summaries and dashboard content for later distribution, creating a built-in natural-language data exfiltration path. In a mailbox-processing skill, this is especially sensitive because emails commonly contain commercial, personal, or confidential operational data that may be forwarded more broadly than the original mailbox audience.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 生成待翻译清单（供 agent 在自动化里做 LLM 中文翻译/归纳） if os.path.exists("prep_cn.py"): try: subprocess.run([sys.executable, "prep_cn.py"], cwd=WS, check=True) except Exception as e: sys.stderr.write("prep_cn warn: %s\n" % e)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 简易主题中文翻译（Python 兜底版，与 JS 的 trSubj 对齐； # pick_summary 在 CN 缺失时调用，确保飞书 message 也能给点中文提示） _RE_R = __import__('re').compile(r'^\s*(RE|Re|FW|Fw|FYI|AW|Aw|SV|VS|TR|FS|FBL|R)(\s*[：:.\-]\s*)', __import__('re').I) _TR_PAIRS = [ (r'DE[\s_]+POSM\b', '德国 POSM'), (r'FR[\s_]+POSM\b', '法国 POSM'),
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated digest/card explicitly includes translated summaries and main content meant for push delivery, which materially broadens exposure of mailbox information beyond the original email context. Given the skill is designed for automated daily pushes, this can repeatedly leak sensitive business details if the data is over-inclusive, mis-summarized, or sent to the wrong recipient.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code sends email-derived summaries and an HTML attachment to a Feishu recipient using
OPEN_IDfrom config/environment, without any in-file confirmation, recipient verification, or data-classification guardrail. Because the skill's purpose is to aggregate recent mail, a misconfigured or maliciously set recipient ID can exfiltrate business-sensitive mailbox content at scale through normal bot delivery channels.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script serializes processed email-derived content into a local file,
workboard2_data.json, including message metadata, participants, bodies, progress summaries, todos, and deadlines. In this skill's context, the data originates from recent business email and likely contains sensitive operational and personal information; writing it to disk without access controls, minimization, or explicit disclosure increases the risk of unintended retention, local exposure, or downstream exfiltration by other components.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generated document hard-codes
lang="zh-CN"and presents the primary interface title/content in Chinese, which imposes a specific language/locale choice on users. The file does not offer language selection or explain a justified region-specific constraint.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Untrusted email-derived data is serialized directly into an inline . An attacker controlling email subject, participant name, or body-derived fields could inject script-breaking content into the generated dashboard HTML, leading to stored XSS when the recipient opens the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language instructions entirely in Chinese, including the main module docstring and later user-facing prompts/output, with no opt-in or alternative locale. That creates a language-policy concern because the skill effectively requires a specific language for installation and operation guidance.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer tells users that leaving open_id blank means the board will only be generated locally without push, but it unconditionally writes push_enabled = True. In an automation/push skill, this configuration mismatch can cause later components to attempt delivery when the user believed push was disabled, leading to unintended disclosure or misrouting of email-derived summaries.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This is the same underlying security-relevant defect expressed through user-facing documentation: the code promises '留空=只本地生成不推送' yet persists a state that marks pushing as enabled. Because the skill processes recent email and can send Feishu cards/attachments automatically, misleading users about delivery state increases the risk of accidental data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script exports mailbox-derived content into cn_inbox_full.json, including message excerpts, subjects, participants, and operational metadata, without any consent gate, minimization warning, or sensitivity controls. In this skill’s context, that data is then prepared for downstream translation/summarization workflows, which increases the chance of unnecessary exposure of personal, business, or confidential email content beyond the original mailbox.
- Content
Static analysis
No suspicious patterns detected.