Web To Fim

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 3.7.0

Overview

The skill is mostly coherent, but needs review because it can automatically fetch content and upload it to Feishu and Tencent IMA with insufficient guardrails around cloud transfer and content-derived URLs.

Install only if you are comfortable with selected URLs or local files being written locally and sent to Feishu and Tencent IMA. Prefer using --no-feishu and --no-ima unless you explicitly want cloud storage, avoid sensitive or regulated documents, and review Feishu wiki original links before processing them. Pin and review dependencies before using this in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/web_to_all.py:478

Finding

Server-Side Request Forgery Through Content-Derived Original URLs

Content

View full analysis

len(markdown): print(f"✅ X original fetched: {len(orig_markdown)} chars (was {len(markdown)})") markdown = orig_markdown else: print(f"⚠️ X original shorter than feishu wiki, keeping feishu content") except Exception as e: print(f"⚠️ X original fetch failed: {e}, using feishu wiki content (fallback)") # WeChat or ordinary web original: use markitdown elif "mp.weixin.qq.com" in lower_orig or lower_orig.startswith("http"): try: orig_markdown = convert_to_md(original_url) if len(orig_markdown) > len(markdown): print(f"✅ Web original fetched: {len(orig_markdown)} chars (was {len(markdown)})") markdown = orig_markdown else: print(f"⚠️ Web original shorter than feishu wiki, keeping feishu content") except Exception as e: print(f"⚠️ Web original fetch failed: {e}, using feishu wiki content (fallback)") ``` ```python # scripts/web_to_md.py:112-119 def _convert_markitdown(url_or_path: str, output_path: str = None) -> str: try: from markitdown import MarkItDown except ImportError: print("❌ markitdown not installed. Run: pip install markitdown", file=sys.stderr) sys.exit(1) md = MarkItDown() result ...[truncated 2500 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:334

Finding

Unpinned Mutable Dependencies and Execution of Unverified Third-Party Code

Content

View full analysis

str: fetch_cmd = [sys.executable, TWEET_FETCHER, "--url", url, "--pretty"] if replies: fetch_cmd.append("--replies") ``` The command is subsequently executed through: ```python result = subprocess.run( cmd, capture_output=True, text=True, check=check, timeout=timeout ) ``` ### Technical Analysis The installation instructions retrieve packages without fixed versions or integrity hashes. The optional X/Twitter integration instructs users to clone the current state of a third-party Git repository without pinning a reviewed commit, tag, signed release, or checksum. The resulting `fetch_tweet.py` is then executed with the same Python interpreter and operating-system privileges as the Skill. There is no integrity verification or sandboxing before execution. This does not prove that any current dependency is malicious. The vulnerability is that the effective executable code can change after the Skill itself has bee ...[truncated 1708 chars]

Remediation

View remediation

``` 6. Verify downloaded source against a published checksum or signature before execution. 7. Prefer vendoring the minimal reviewed fetcher code into the project when licensing permits. 8. Execute optional converters in a sandbox with: - No unnecessary environment variables - Restricted filesystem access - Restricted outbound network access - No access to authenticated cloud CLI configuration 9. Add automated dependency scanning and scheduled review of pinned versions. 10. Document the provenance and reviewed version of every executable dependency. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the core 'three-destination save' workflow is not actually implemented while adjacent write/integration capabilities exist, users may invoke the skill under false assumptions about what data is stored where and how. In security-sensitive environments, that kind of description-behavior drift is dangerous because it undermines informed consent, auditability, and policy enforcement for external uploads and document creation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the core 'three-destination save' workflow is not actually implemented while adjacent write/integration capabilities exist, users may invoke the skill under false assumptions about what data is stored where and how. In security-sensitive environments, that kind of description-behavior drift is dangerous because it undermines informed consent, auditability, and policy enforcement for external uploads and document creation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the core 'three-destination save' workflow is not actually implemented while adjacent write/integration capabilities exist, users may invoke the skill under false assumptions about what data is stored where and how. In security-sensitive environments, that kind of description-behavior drift is dangerous because it undermines informed consent, auditability, and policy enforcement for external uploads and document creation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 26)May include surrounding context.

python

历史安全说明:
- 所有凭证通过环境变量读取，不硬编码
- 支持 .env 文件加载（需 python-dotenv）
- 凭证不写入日志或任何输出

历史 Usage:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes conversion and storage to Obsidian, Feishu Cloud Docs, and Tencent IMA, but does not prominently warn that local files and fetched web content may be uploaded to third-party cloud services. This omission materially increases the risk of users exposing sensitive local documents, private URLs, or regulated data because the skill handles both local and remote sources and performs multi-destination storage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is broad enough that ordinary user requests involving a URL or file and a vague request to 'convert to a document' could invoke a workflow that fetches content and stores it across multiple destinations, including external cloud services. In this skill’s context, over-broad activation is more dangerous because it can cause unintended data movement from local files or private web content into Feishu and Tencent IMA without a narrowly scoped confirmation step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README prominently advertises one-click conversion and storage to Obsidian, Feishu, and Tencent IMA, but does not provide a clear upfront warning that supplied URLs or local files may be copied to cloud services and become visible outside the local machine. Given the skill supports local documents and multiple external sinks, missing privacy and data-handling warnings can cause users to upload sensitive content unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger definition is broad enough that a generic request involving any URL or local file plus a request to save or convert documents could invoke a workflow that reads local content and sends data to external destinations. In this skill, that broadness is more dangerous because the action chain includes local filesystem access and uploads to Feishu and IMA, increasing the chance of unintended data processing or exfiltration from an ambiguously phrased user request.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares substantial capabilities including file read/write, network access, environment-variable access, and subprocess execution, but does not expose a machine-readable tool scope such as permissions or allowed-tools. This creates a least-privilege gap: a host may not be able to enforce or audit the intended boundaries, increasing the chance of over-broad execution or unsafe deployment assumptions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains broad everyday phrases such as generic 'url转文档' or '文件转飞书', which can cause accidental activation on ordinary user requests. Because this skill performs local file handling, subprocess calls, and third-party uploads, unintended triggering can lead to unplanned data movement to cloud services or local writes without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feishu-blocks.md (reported line 133)May include surrounding context.

python

for i in range(0, len(blocks), 50):
    batch = blocks[i:i+50]
    requests.post(url, headers=headers, json={"children": batch})

5. payload 中不要传 index

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document forces a specific language for all instructions, warnings, and operational guidance. Under the policy, language constraints should either be optional for the user or clearly documented as justified for a region-specific tool, which is not stated here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file claims it is retained only for historical reference and should not be used, but it remains fully runnable as both a library and CLI. In an agent-skill context, dormant but executable legacy code increases attack surface and raises the risk of accidental invocation of outdated behavior that handles user content and credentials contrary to current security assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Natural-language strings throughout the module, including the module docstring, error messages, CLI help, and status output, are written only in Chinese. This imposes a specific language on users without an opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 84)May include surrounding context.

python

"app_secret": self.app_secret
        }

        resp = requests.post(url, json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Tainted flow: 'url' from requests.post (line 243, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 84)May include surrounding context.

python

"app_secret": self.app_secret
        }

        resp = requests.post(url, json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module is marked deprecated and the skill description says current behavior should upload Markdown files to the user's cloud drive, yet this code still creates Feishu online docx documents with application credentials. That mismatch can cause data to be stored under the wrong identity or in an unexpected location, undermining user expectations and potentially exposing documents to unintended administrative scopes.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from requests.post (line 243, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 123)May include surrounding context.

python

"""
        url = f"{self.BASE_URL}/docx/v1/documents"
        payload = {"title": title}
        resp = requests.post(url, headers=self._headers(), json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Tainted flow: 'url' from requests.post (line 243, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 151)May include surrounding context.

python

"""
        url = f"{self.BASE_URL}/docx/v1/documents"
        payload = {"title": title}
        resp = requests.post(url, headers=self._headers(), json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()

Tainted flow: 'url' from requests.post (line 243, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/feishu_client.py (reported line 244)May include surrounding context.

python

def get_document_info(self, document_id: str) -> Dict[str, Any]:
        """获取文档信息"""
        url = f"{self.BASE_URL}/docx/v1/documents/{document_id}"
        resp = requests.get(url, headers=self._headers(), timeout=30)
        resp.raise_for_status()
        return resp.json()

Tainted flow: 'payload' from requests.post (line 245, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/ima_client.py (reported line 72)May include surrounding context.

python

"""
        base_path = path or self.NOTES_PATH
        url = f"{self.BASE_URL}{base_path}/{api_name}"
        resp = requests.post(url, headers=self._headers(), json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") != 0:

Tainted flow: 'payload' from requests.post (line 245, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/ima_client.py (reported line 84)May include surrounding context.

python

"""
        base_path = path or self.NOTES_PATH
        url = f"{self.BASE_URL}{base_path}/{api_name}"
        resp = requests.post(url, headers=self._headers(), json=payload, timeout=30)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/web_to_all.py (reported line 233)May include surrounding context.

python

if not lark_cli:
            raise RuntimeError("lark-cli not found in PATH. Install via npm i -g @larksuiteoapi/lark-cli and run lark-cli auth login.")

        result = subprocess.run(
            [lark_cli, "drive", "+upload", "--file", f"./{upload_name}", "--name", upload_name],
            capture_output=True,
            text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uploads converted Markdown to Feishu cloud drive whenever Feishu output is enabled, with no explicit confirmation step at execution time and no data-classification warning. Because this skill is designed to ingest arbitrary web pages and local files, it can easily exfiltrate sensitive local content or copyrighted/private material to a third-party cloud service if triggered unintentionally or with ambiguous user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends either full converted content or source URLs to Tencent IMA automatically when IMA is enabled, again without a clear user-facing confirmation at the point of transfer. In the context of this skill, which supports local files and arbitrary URLs, this creates a real privacy and data-governance risk because users may not realize their content is being transmitted to an external knowledge-base service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.