T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wiki_search.js:10- Finding
Hard-Coded Feishu Application Credentials Expose Tenant Resources
- Content
View full analysis
- Remediation
View remediation
Security audit
亚协瑜伽馆经营顾问yaxie--consultant
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent knowledge-base purpose, but it publishes reusable Feishu app credentials that could expose tenant resources to anyone who receives the skill.
Do not install or use this version until the Feishu App Secret has been revoked and rotated, removed from all published files and history, and replaced with protected runtime secret injection. Confirm the app has read-only least-privilege access to only the intended knowledge-base space, and restrict or remove object-token exposure and arbitrary output paths.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill advertises search, reading, and summarization for a specific knowledge base, but the described behavior includes use of undeclared external APIs, hardcoded credentials, and disclosure of internal object tokens. Even if some capability gaps are functional quality issues rather than security issues, exposing authenticated access mechanisms and internal identifiers is a real security concern because it lowers the barrier to unauthorized enumeration and retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill advertises search, reading, and summarization for a specific knowledge base, but the described behavior includes use of undeclared external APIs, hardcoded credentials, and disclosure of internal object tokens. Even if some capability gaps are functional quality issues rather than security issues, exposing authenticated access mechanisms and internal identifiers is a real security concern because it lowers the barrier to unauthorized enumeration and retrieval.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises search, reading, and summarization for a specific knowledge base, but the described behavior includes use of undeclared external APIs, hardcoded credentials, and disclosure of internal object tokens. Even if some capability gaps are functional quality issues rather than security issues, exposing authenticated access mechanisms and internal identifiers is a real security concern because it lowers the barrier to unauthorized enumeration and retrieval.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### scripts/wiki_search.js - 搜索文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### scripts/wiki_search.js - 搜索文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### scripts/wiki_search.js - 搜索文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### scripts/wiki_list.js - 列出所有文件
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### scripts/wiki_list.js - 列出所有文件
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The skill documentation directly includes an App ID and App Secret and instructs operators to use them. This is a clear secret exposure vulnerability: anyone with repository or skill access can reuse the credentials to obtain tenant access tokens and interact with the associated Feishu resources, potentially leading to unauthorized data access or exfiltration.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Publishing raw application credentials without any warning or access restriction is a direct and severe security issue. In this skill's context, the danger is amplified because the stated purpose is simple knowledge retrieval, so reviewers may overlook that the documented credentials can be abused to access backend Feishu APIs far beyond a harmless local reference.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Hardcoded application credentials are a direct secret exposure. An attacker who obtains this script can request valid access tokens from Feishu and potentially access or enumerate tenant knowledge-base data, making this a high-severity credential leakage issue with downstream data exposure risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L03 将触发场景定义为“用户询问瑜伽馆经营问题”“需要调用亚协知识库内容回答”“查询馆主关心的经营痛点解决方案”，这些条件范围较大，缺少明确边界或排除条件。文档也未提供更具体的触发短语、限定上下文或负例，容易在一般经营咨询场景中被不明确地调用。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
L03 的自然语言描述完全以中文定义技能用途和触发方式，面向交互时未说明是否支持用户选择其他语言或仅限特定中文业务场景。按组织语言/区域政策，若技能隐含固定语言而无用户选择或明确的区域合规说明，可能构成语言策略问题。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code embeds Feishu APP_ID and APP_SECRET directly in the script, allowing anyone with source access to reuse the credentials to obtain tenant access tokens and query the knowledge base. In the context of a read-only knowledge skill, this creates unnecessary privileged access and turns source disclosure into credential compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script makes HTTPS requests to Feishu, sends authentication material, and retrieves file metadata from a knowledge-base space. Although the script name implies listing files, there is no explicit disclosure in comments or output that it will contact a remote service and access workspace data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest presents this skill as a knowledge-base reading capability used to answer yoga studio business questions via keyword search, file reading, and knowledge summarization. This script instead performs bulk traversal of all wiki nodes in a space and collects every file entry, which is a broader inventory/listing operation not described in the stated skill behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script contains hard-coded Feishu application credentials and uses them to obtain an access token for network requests. Embedded secrets in a skill file are highly dangerous because anyone with code access can extract them, reuse the app identity, and access associated APIs or data far beyond the intended workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The DOCX parser dynamically writes a Python script and executes it via child_process.exec. Even though the current filePath is internally generated, spawning an external interpreter increases attack surface, depends on ambient system tooling, and can become command-injection-prone if path handling changes or if surrounding code later accepts less trusted input.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The PDF reader also creates and executes a temporary Python script, again expanding the trusted computing base and introducing parser risk on remote content. Because this skill downloads attacker-influenceable files from a remote document platform, feeding them into an external parser can expose the host to parsing bugs or unsafe execution paths in the runtime environment.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script accepts a user-supplied output path and writes extracted content there with fs.writeFileSync without any path restriction, validation, or confirmation. In a knowledge-base reader, this creates an unnecessary arbitrary file write primitive that could overwrite local files if an attacker can influence the second argument or if the skill is invoked by another component with untrusted input.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script embeds live Feishu application credentials and uses them to obtain a tenant access token for external API access. Hardcoded secrets in a distributable skill are highly sensitive because anyone with access to the code can reuse them to enumerate or access the associated workspace, which exceeds the stated purpose of a local knowledge-base reading skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code obtains an access token by sending the app ID and app secret to Feishu and then queries the wiki space for file metadata. Although comments describe the API calls, there is no user-facing warning, prompt, or disclosure that credentials will be used and remote requests will enumerate workspace files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script prints Feishu object tokens for matched files, which exposes internal workspace identifiers that are not necessary for answering user knowledge queries. These tokens can aid follow-on API abuse, content enumeration, or unauthorized retrieval when combined with valid credentials or broader access elsewhere.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The markdown file is entirely presented in Chinese, beginning with the title at L001, with no indication that users can choose another language or locale. Under the stated policy, fixed language presentation without opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Comments and console output are written entirely in Chinese, which imposes a specific language on users without opt-in or explanation. Under the policy, fixed language or locale behavior should either offer a choice or clearly justify the constraint.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/wiki_read.js:87