T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/card_validator.py:115- Finding
Malformed Card Structures Cause Validator Denial of Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Card Design 飞书卡片消息设计规范
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Feishu/Lark card design and validation helper; it has a validator reliability bug and broad examples, but I found no hidden execution, credential access, persistence, or exfiltration behavior.
Install only if you want a Chinese-first Feishu Card 2.0 design/template helper. Review and approve any generated card links, callback payloads, and actual OpenAPI message-sending code separately, and do not rely on the validator as a hardened security boundary until malformed-input handling is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill repeatedly presents itself as a 'pure specification' skill that does not directly perform operations, yet it also advertises runnable builder/converter/validator scripts that parse Markdown and write Card JSON. This mismatch can mislead an agent or reviewer about the skill’s real operational behavior, causing it to be invoked in contexts where file transformation or output generation was not expected.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | 本文件，主入口 |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest file explicitly lists trigger words, so SQP-1 applies. "IM 提醒样式" is a generic phrase that could describe many messaging or notification-formatting tasks beyond Feishu Card 2.0 design, increasing the chance of unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill description states that it is a pure specification skill and does not directly send Feishu messages, but this trigger phrase implies operational message delivery. That mismatch can cause the skill to activate for sending requests outside its intended scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
SQP-3 applies to all file types, including manifest-style markdown with front matter. Setting
language: zh-CNcan be a locale policy violation when the skill appears broadly applicable to all Agent platforms and does not indicate opt-in, fallback behavior, or region-specific necessity.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The user-facing title, subtitle, action descriptions, and button text are entirely in Chinese throughout the JSON content. For a general action-list artifact, this imposes a specific language/locale without any visible opt-in, alternate language option, or stated regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JSON report contains user-facing natural-language content entirely in Chinese across the title, subtitle, markdown blocks, and button text. Because the file does not offer a language selection or explain that it is intentionally limited to a Chinese-speaking or region-specific audience, it appears to impose a specific language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This JSON file is a manifest-style file, so natural-language policy checks apply. The title and subtitle force Chinese-language output, and the file provides no user opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The user-facing title, subtitle, section headings, and report body are entirely in Chinese, indicating the skill output is fixed to a specific language. There is no visible opt-in, language selection, or justification that this report is intended only for a Chinese-language or region-specific audience.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger word at line 14 is broad enough to match ordinary user discussion about Feishu cards rather than a deliberate request for this specific skill. That can cause unintended skill activation, injecting this skill’s guidance or templates into unrelated workflows and increasing the chance of prompt-scope confusion across agents.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The trigger word at line 15 is ambiguous and does not clearly constrain activation to this skill’s stated scope of design/specification. In multi-skill environments, ambiguous triggers can invoke the wrong skill, causing misrouting, unexpected transformations, or policy bypass through accidental context switching.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is written as a universal requirement for card generation and is headed entirely in Chinese, effectively prescribing Chinese-language output conventions for all Agent-generated cards. The document does not offer a language choice or explain that the schema guidance is region- or locale-specific, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is written entirely in Chinese and presents prescriptive guidance for the skill's output format, but nowhere indicates that language selection is optional or limited to a specific Chinese-speaking deployment context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Although the skill is described as a pure design/specification skill, this section embeds executable-style message-sending fallback logic. That mismatch can cause downstream agents or integrators to treat the skill as authorized to send IM content, expanding capability scope and increasing the chance of unintended outbound messaging or unsafe code reuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file title and all instructional content are written in Chinese, and the examples prescribe Chinese text for card titles, labels, and content. For a generally reusable layout-pattern reference, this imposes a specific language/locale without any user opt-in or justification that the skill is region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L305-L309 明确写明
note元素在 Card 2.0 V2 已废弃并要求改用markdown。但同一文件此前在 L23、L36、L60 以及后续多个布局示意中继续把Footer note作为必填或标准组成部分，形成直接的文档内部意图冲突，容易让使用者按已废弃模式设计卡片。- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is described as a pure card design/specification helper that should not directly support message actions, yet the builder exposes a generic button API that can embed arbitrary open_url behaviors. This expands the skill from passive formatting into action-enabling message construction, which can be abused to generate phishing links or unsafe user-triggered navigation through cards produced by downstream agents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The button builder also supports callback behaviors, enabling interactive card actions even though the skill's stated purpose is design规范 only. Callback-capable actions can trigger downstream workflows or state-changing operations when cards are rendered in a broader agent ecosystem, creating an unnecessary action surface that is inconsistent with the declared non-operational scope.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring says exit code 1 means warnings and 0 means all passed, implying warnings should produce a nonzero exit status. However, the non-stdin CLI path exits with 0 when warnings exist and --strict is not set, so the documented behavior is contradicted by the implementation. This is an intent-level mismatch in the tool's documented contract.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes this as a pure Feishu card design/specification skill and explicitly says not to use it for 飞书云文档编辑/多维表格操作/IM 群管理. In code, the converter accepts a doc_url and renders a prominent '查看完整云文档' button, which extends the skill beyond pure card-format specification into document-linking workflow support tied to cloud docs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The template embeds interactive open_url button behaviors, which goes beyond a purely presentational/design-specification role and introduces a navigation capability. If downstream systems render this template with untrusted or attacker-controlled URL variables, users can be redirected to phishing, malware, or misleading external content from a trusted-looking Feishu card.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The hardcoded external URL capability creates an unnecessary outbound navigation path in a skill described as a design/rendering standard. Even though the example.com target is inert as shown, normalizing hardcoded click-through actions in a spec template can lead to unsafe reuse with real external destinations without adequate review.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template metadata explicitly instructs consumers to copy the file and use it with the Feishu OpenAPI to send messages, which conflicts with the skill's declared scope as a pure design/specification skill that does not send Feishu messages. This mismatch can mislead downstream agents or users into performing operational messaging actions outside the intended trust boundary, increasing the chance of unintended message dispatch or policy bypass.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template contains a primary button that opens a cloud document URL, despite the skill description explicitly stating it should not be used for Feishu cloud document operations. Even though this is only a template, embedding a document-action pattern normalizes prohibited usage and can cause agents to generate cards that direct users into restricted document workflows.
- Content
Static analysis
No suspicious patterns detected.