Security audit

分贝通飞书集成能力问答

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed Q&A knowledge base, but it requires storing customer details and sending them through Feishu without clear consent or privacy controls.

Install only in an environment where customer requirement logging and Feishu escalation are approved. Before use, add consent, redaction, recipient verification, access control, and retention rules, and remove any broad @everyone escalation path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:25
Finding: Mandatory Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/process.md:7
Finding: Unconsented Persistent Storage of Customer Questions and Context
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/process.md:30
Finding: Mandatory External Disclosure of Customer Requirements Through Feishu
Content: View full analysis
Fenbeitong and Feishu Integration — Item Pending Confirmation > **Customer**: xxx > **Requirement**: xxx > **Urgency**: Red / Yellow / Green > **Pending confirmation item**: xxx > **Time**: xxx > Details: `memory/unanswered-questions.md` ``` The mandatory nature of disclosure is reinforced in `references/faq.md`, lines 24-26: ```markdown - Never fabricate an answer. - Every uncovered question must be reported immediately; it must be recorded and reported when encountered. - Notification target: send a private Feishu message to Feishu integration product owner Qi. ``` ### Technical Analysis The Skill requires customer information to be transmitted outside the current conversation to a named recipient through Feishu. For urgent cases, it additionally permits telephone discl ...[truncated 2206 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill hard-codes Chinese-language behavior and output formatting without indicating that it should adapt to the user's preferred language. This can cause incorrect or inaccessible responses for users operating in other languages, reducing usability and potentially causing misunderstandings in business integration guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file presents all user-facing capability descriptions in Chinese only, which can amount to a language/locale policy violation when no opt-in or alternative language is offered. The content does not state that the skill is limited to a Chinese-speaking audience or a China-specific deployment context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire FAQ and its mandatory instructions are written only in Chinese, with no indication that users may choose another language or locale. This can violate a language/locale policy when the skill is used in broader contexts, because it effectively constrains operation to Chinese without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document instructs the agent to notify a specific individual via Feishu private chat, which introduces an external communication path that can transmit user-derived or sensitive operational information outside the immediate interaction. In a skill with no clearly justified need for outbound messaging, this creates a data exfiltration and unauthorized escalation risk, especially if unanswered questions contain customer details or internal context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L58写明“差旅申请单同步”在市场版/嵌入版均支持，但L59-L60又在同一“People 能力对接”表格中声明“组织架构同步”“假勤同步”不支持；同时前文L48-L52明确宣称“假勤集成”支持将差旅申请单自动同步到飞书假勤系统。该文档内部对同一集成能力是否支持给出了互相冲突的说明，属于意图与内容不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill documentation is written in Chinese and does not provide any indication that language selection is optional or constrained to a China-specific audience. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document instructs users to record detailed customer information and unmet requirements in a shared markdown file and to forward summaries through Feishu, but it provides no data-minimization, access-control, retention, or privacy-handling guidance. This can lead to unnecessary storage and dissemination of customer names, business needs, and contextual details, increasing the risk of unauthorized exposure or noncompliant handling of potentially sensitive business data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill requires writing unanswered questions into a persistent memory file, creating storage of potentially sensitive user inputs or business context without any stated retention, minimization, or access-control constraints. While operationally useful, persistent logging expands the data exposure surface and can preserve confidential information longer than necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.