Feishu Owner Transfer Advanced

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

The skill performs the advertised Feishu ownership-transfer task, but it can transfer broad sets of documents without default dry-run, confirmation, or consistent limits to AI-owned files.

Install only if you intend to let this skill use an authenticated lark-cli account to change Feishu document ownership. Prefer dry-run first, verify every target and source owner, avoid broad wiki/root transfers unless you have tenant authority, and do not rely on the documentation's human-owner skipping claim for all modes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/transfer_owner.py:76

Finding

Ownership transfers do not consistently prevent reassignment of human-owned documents

Content

View full analysis

{args.target}") ``` Wiki transfer mode in `scripts/transfer_wiki.py:142-155`: ```python # 跳过已是目标所有者的 if current_owner == args.target: print(f"{indent} ✅ 已是目标所有者，跳过") skipped += 1 print() continue if args.list: print(f"{indent} [DRY-RUN] 将转移 -> {args.target}") transferred += 1 else: resp = transfer_owner(ftype, docs_token, args.target, args.member_type) if resp.get("code") == 0: print(f"{indent} ✅ 转移成功") transferred += 1 ``` ### Technical Analysis The Skill declares that it transfers documents created by an AI agent and automatically skips files already owned by humans. Root-directory batch mode implements a heuristic for this behavior by treating owner IDs beginning with `ou_` as human owners. That protection is not applied consistently: 1. In single-token mode, the script retrieves and displays the current owner but transfers the document without checking whether that owner is an AI identity, a permitted source owner, or a human. 2. In Wiki mode, the only ownership restriction is that a document already owned by the destination user is skipped. Any other accessible document is s ...[truncated 2959 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill advertises capabilities such as wiki-space scanning and dual invocation modes that are not actually implemented as described. This mismatch is dangerous because users and orchestration layers may trust the declared behavior and approve actions under false assumptions, increasing the chance of unintended bulk transfers or execution paths that have not been properly reviewed.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes shell-executable operational steps but does not declare any tool scope or permission boundaries. In an agent environment, missing explicit tool constraints can let the skill invoke command execution more broadly than users expect, which is risky because the documented commands perform ownership-changing actions against external systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to match ordinary conversation about documents, transfers, or ownership. In a skill system, that can cause accidental activation of a high-impact workflow that changes ownership of documents, especially when combined with batch modes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill supports bulk ownership transfer but does not present a prominent warning about the scope and consequences of transferring many documents. That omission raises the risk of users invoking a destructive administrative action without understanding that it may affect all root Drive files or large wiki-linked content sets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

"remove_old_owner": False, "cancel_notify": False } resp = requests.post(url, json=data, headers=headers) print(resp.json())

text

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transfer_owner.py (reported line 19)May include surrounding context.

python

cmd = ["lark-cli", "api", method, path]
    if data:
        cmd += ["--data", json.dumps(data)]
    result = subprocess.run(cmd, capture_output=True, text=True)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transfer_wiki.py (reported line 13)May include surrounding context.

python

cmd = ["lark-cli", "api", method, path]
    if data:
        cmd += ["--data", json.dumps(data)]
    result = subprocess.run(cmd, capture_output=True, text=True)
    try:
        return json.loads(result.stdout)
    except json.JSONDecodeError:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is entirely in Chinese, and the CLI help/descriptions are also presented only in Chinese. This imposes a language choice on users without opt-in or an alternative locale, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.