T09 · Insecure Skill Coding Practices
- Location
index.js:4- Finding
Hard-Coded Feishu Application Credentials
- Content
View full analysis
Vulnerability Details
File Location:
index.js:4-5config.json:2-5lead-processor/index.js:4-5lead-processor/config.json:2-5
Vulnerability Type: Hard-coded application secret and plaintext sensitive configuration
Risk Level: HighVulnerable Code
index.js:4-5andlead-processor/index.js:4-5:javascript const FEISHU_APP_ID = process.env.FEISHU_APP_ID || 'cli_a9140ac9cab85bd3'; const FEISHU_APP_SECRET = process.env.FEISHU_APP_SECRET || 'qlySTZmzM567o4TnZDrvOdVNXMqIwaD0';config.json:2-5andlead-processor/config.json:2-5:json "feishu": { "app_id": "cli_a9140ac9cab85bd3", "app_secret": "qlySTZmzM567o4TnZDrvOdVNXMqIwaD0" }The credentials are used to request a Feishu tenant access token in
index.js:14-17and the duplicated implementation:javascript const postData = JSON.stringify({ app_id: FEISHU_APP_ID, app_secret: FEISHU_APP_SECRET });Technical Analysis
A Feishu application ID and application secret are stored directly in source code and plaintext configuration. The source implementation uses environment variables only when they are available; otherwise, it silently falls back to the embedded credentials. Consequently, environment-variable support does not eliminate the exposure.
Anyone able to obtain the package, repository contents, an archive, or retained source history can recover the secret without needing access to the deployment environment. The application submits these credentials to Feishu's tenant access-token endpoint. The resulting bearer token is subsequently used by the code to read Bitable records, update Bitable records, and send chat messages.
The duplicated root and
lead-processor/implementations increase the number of locations from which the secret must be removed. Deleting only one copy would leave the credentials exposed elsewhere in the package.Attack Path
- An attacker downlo ...[truncated 1517 chars]
- Remediation
View remediation
Remediation Suggestions
-
Immediately revoke and rotate the exposed Feishu application secret. Treat it as compromised because it has been distributed in plaintext.
-
Remove the application secret from:
index.jsconfig.jsonlead-processor/index.jslead-processor/config.json- Repository history, release archives, caches, and previously published packages.
-
Require credentials to be supplied through an approved secret manager or deployment-time environment injection. Do not provide a hard-coded fallback:
javascript const FEISHU_APP_ID = process.env.FEISHU_APP_ID; const FEISHU_APP_SECRET = process.env.FEISHU_APP_SECRET; if (!FEISHU_APP_ID || !FEISHU_APP_SECRET) { throw new Error('Required Feishu credentials are not configured'); } -
Keep only non-sensitive configuration in version-controlled JSON files. If local configuration is necessary, provide a placeholder template and exclude the populated file through
.gitignoreand packaging rules. -
Review the Feishu application's assigned scopes and reduce them to the minimum required for the intended Bitable and messaging operations.
-
Audit Feishu authentication and API activity for use of the exposed credentials, including unexpected token requests, record changes, and messages.
-
Add automated secret scanning to commit hooks, continuous integration, release pipelines, and Skill publication workflows.
-
Consolidate the duplicated implementation so that security fixes and credential removal cannot be missed in one copy.
-