T09 · Insecure Skill Coding Practices
Error
- Location
scripts/subscribe_callback_handler.py:12- Finding
MoviePilot Credential Transmitted to a Hard-Coded Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Card Sender
Security checks for vulnerabilities and agentic risk
Overview
This skill sends Feishu cards but also runs callback workflows that can create MoviePilot subscriptions and handle credentials in unsafe ways, so it needs careful review before installation.
Install only if you intentionally want a Feishu-to-MoviePilot automation, not just a card sender. Before use, require HTTPS and an explicit MoviePilot base URL, remove the hard-coded default endpoint, require Feishu callback signature verification, bind callbacks to the original recipient and media, restrict poster downloads to trusted HTTPS image hosts, and protect or avoid plaintext token caches and persistent callback state.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/feishu_callback_worker.py:14- Finding
Public Callback Listener Accepts Unsigned Requests When Its Encryption Key Is Unset
- Content
View full analysis
MAX_SKEW_SECONDS: return False, 'timestamp_skew' base = f"{ts}{nonce}{ENCRYPT_KEY}{raw_body}".encode('utf-8') calc = hashlib.sha256(base).hexdigest() if calc != sig: return False, 'signature_mismatch' return True, 'ok' ``` The accepted request is subsequently trusted and forwarded: ```python header = req.get('header') or {} event = req.get('event') or {} event_type = header.get('event_type') action_value = ((event.get('action') or {}).get('value') or {}) token = str(event.get('token') or '') user_id = ((event.get('operator') or {}).get('open_id')) or USER_ID_FALLBACK if event_type != 'card.action.trigger' or not token or not isinstance(action_value, dict): self._log('callback_rejected', reason='invalid_payload_shape', event_type=event_type, keys=l ...[truncated 2294 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_feishu_card.py:334- Finding
Unrestricted Poster URL Fetch Enables SSRF and Local File Exfiltration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/card_callback_router.py:15- Finding
Feishu Tenant Bearer Token Stored in a Predictable File Without Explicit Access Controls
- Content
View full analysis
120: return c['token'] except Exception: pass token, ttl = get_tenant_token(app_id, app_secret) if token: TOKEN_CACHE.parent.mkdir(parents=True, exist_ok=True) TOKEN_CACHE.write_text( json.dumps({ 'app_id': app_id, 'token': token, 'exp_at': now + max(300, ttl - 60) }), encoding='utf-8' ) return token ``` ### Technical Analysis A privileged tenant access token is written in plaintext to a predictable path. The code does not explicitly create the directory with mode `0700` or the file with mode `0600`. Effective permissions therefore depend on the process umask and existing directory permissions. The write is also not atomic and does not verify that the target is a regular file owned by the expected account. In an environment where another local principal can modify the parent directory, this can introduce symlink or replacement-file risks. ### Attack Path 1. The router obtains a Feishu tenant access token using the configured application secret. 2. The token is written to `tmp/tenant_token_cache.json`. 3. A local principal with sufficient directory or file access reads the cache. 4. The principal extracts the bearer token and uses it directly with Feishu APIs be ...[truncated 580 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/card_callback_router.py:115- Finding
Callback Authorization Is Not Bound to the Original Card Recipient or Stored Media Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/feishu_callback_worker.py:315- Finding
Sensitive Feishu Callback Tokens and User Identifiers Are Written to Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (61)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to send Feishu card messages, but the documented callback flow performs MoviePilot subscription queries/creation, reads local credentials for external services, and maintains local idempotency state. Hidden cross-system write capabilities materially elevate risk because a user invoking a messaging skill may unknowingly authorize writes to another external system.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This document describes callback handling that can create MoviePilot subscriptions, which is materially broader than the declared purpose of a skill that should only send Feishu interactive cards via OpenAPI. That scope expansion introduces an undeclared write path into an external system, increasing the chance of unauthorized actions through crafted callback payloads or operator misuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented behavior includes querying and writing to an external MoviePilot subscription API, which gives this skill side-effecting capabilities unrelated to Feishu card delivery. In the context of a messaging skill, such hidden integration is especially risky because interactive card callbacks can become a bridge for unauthorized state changes in another system if not strongly bound to authenticated users and approved actions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script executes a separate local handler with user-controlled payload data, creating an additional execution boundary and broadening the skill from simple card sending into local orchestration of other code. In a skill context, this is dangerous because any weakness or unexpected behavior in the downstream handler inherits the privileges of this process and may process untrusted callback data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata says it only sends Feishu cards via OpenAPI and does not use the message channel, but this file exposes a network listener on 0.0.0.0:18081, accepts Feishu callbacks, decrypts/verifies requests, extracts user identity, and routes actions into another local script. That is a materially broader capability than declared, increasing attack surface and enabling external event-driven behavior that users and operators would not reasonably expect from a send-only skill.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file performs MoviePilot subscription creation and lookup based on callback input, which is outside the declared scope of a Feishu card sender skill and introduces privileged side effects on an external system. This scope mismatch is dangerous because users or reviewers may authorize a messaging skill while the code actually drives subscription-management actions using stored credentials and network calls.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documentation exposes capabilities that imply environment access, local file read/write, shell execution, and network access, but it does not declare any tool scope restrictions such as permissions or allowed-tools. This creates an over-privileged skill surface where an agent may invoke broader capabilities than a user would reasonably expect from a 'send Feishu card' utility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation instructs sending card content and recipient identifiers such as open_id/chat_id to Feishu, but it does not clearly warn users that their content and identifiers will be transmitted to an external service. This omission can lead to unintended disclosure of sensitive data, especially when the card payload includes structured notifications or personal information.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation describes the skill as only sending Feishu cards, but later declares callback routing and automatic 'subscribe now' handling that writes into MoviePilot. This is a scope deception issue: hidden side effects on an external system can surprise users and bypass informed approval of state-changing operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The callback flow automatically performs subscription writes to MoviePilot after a card action, but the documentation does not provide a clear user-facing warning that this modifies external system state. Automatic write actions tied to callbacks can cause unintended subscriptions or business-side effects without sufficiently informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JSON manifest contains user-facing validation messages entirely in Chinese, such as "title 不能为空" and the poster guidance text, with no indication that the skill is China-specific or that users can opt into the locale. The policy explicitly calls out language or locale policy violations when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file contains multiple user-facing validation/error messages in Chinese, such as 'title 不能为空' and the longer poster image guidance text. Because the file provides only Chinese output and does not offer locale selection or document a justified region-specific constraint, it creates a language/locale policy issue under the natural-language policy category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JSON template contains user-facing labels such as '剧情简介' and other Chinese text directly in the rendered content. Because the file forces a specific language in multiple UI strings and provides no user opt-in or locale selection, it violates the language/locale policy for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The header title is fixed as '🎬 《${title}》电影介绍', which presents the card in Chinese regardless of user language preference. This is a natural-language policy issue because the template enforces one language rather than offering a configurable or justified locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JSON template contains multiple user-facing strings in Chinese, such as section headings and button text, and does not indicate any user opt-in or locale selection. That creates a language-policy issue because the skill appears to force a specific language for all users rather than offering a choice or documenting a region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The worker builds and executes an external Python command via subprocess.run to process queued jobs, but there is no confirmation prompt, user-visible logging, or explanatory comment/docstring disclosing that external command execution will occur. For a code file, subprocess or shell execution should have some visible disclosure unless clearly documented as part of the skill's stated purpose in accompanying markdown, which is not evident from this file alone.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python '--account-id', str(data.get('account_id', '1')), '--payload', json.dumps(data['payload'], ensure_ascii=False), ] return subprocess.run(cmd, capture_output=True, text=True, timeout=180) def recover_orphan_processing_files():
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The cleanup_history function silently deletes files beyond retention limits using unlink, and the finally block also deletes claimed job files after processing. The file contains no user-facing warning, logging, or explanatory comment describing these deletions, which are safety-relevant file operations under the code-file criteria.
- Content