Security audit

Feishu Md2blocks

Security checks for vulnerabilities and agentic risk

Overview

This skill is a purpose-aligned Feishu document helper, but users should be careful with its explicit replace mode because it can delete existing document blocks.

Install only if you are comfortable letting the skill use your configured Feishu app credentials to modify documents and send the Markdown you provide to Feishu APIs. Prefer append or --after for normal use, and only use --replace after confirming the doc_token and keeping your own backup or version history available.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Confidence: 95% confidence
Finding: When --replace is supplied, the script deletes all existing top-level document blocks before inserting new content, and it does so without any confirmation, preview, backup, or rollback. In an agent or automation context, a mistaken invocation, wrong doc_token, or malicious prompt steering could irreversibly wipe important document content.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill invokes a Python script that makes Feishu API network calls, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a capability/metadata mismatch that can bypass expected review boundaries, causing the runtime to perform external network actions that are not clearly disclosed to users or policy enforcement layers.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill description emphasizes inserting/appending Markdown into Feishu docs, but the script also supports a destructive --replace mode that deletes all existing top-level document content. This mismatch can mislead users or calling agents into invoking a capability with materially higher impact than advertised, increasing the risk of accidental data loss.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This code reads Feishu app credentials from a local config and immediately sends them to the Feishu authentication endpoint, but there is no user-facing notice at the time of execution beyond the module docstring. For code files, network calls that transmit credentials or system data should have some visible disclosure such as a print/log message, confirmation, or explicit warning in accompanying markdown.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends the full markdown content to Feishu's remote conversion API, which may include user data, but the code provides no explicit runtime disclosure that document contents are being uploaded. Although conversion is the script's purpose, the requirement here is about warning on network transmission of user data when no visible disclosure is present.

Static analysis

No suspicious patterns detected.