T09 · Insecure Skill Coding Practices
- Location
SKILL.md:48- Finding
Automatic Disclosure of Candidate Data to a Hard-Coded Feishu Collaborator
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:48-53,SKILL.md:64-72,SKILL.md:94-95, andreferences/evaluation-template.md:12-16
Vulnerability Type: Hard-coded external recipient and insecure handling of sensitive candidate information
Risk Level: HighVulnerable Code
SKILL.md:48-53:bash cat /tmp/interview_questions.md | node scripts/feishu_bot_doc.mjs create \ --title "【AI生成】{候选人姓名} {岗位} 面试题集" \ --stdin \ --folder AZ3nfFtial4bHTdOFahcdcfxnub \ --collaborator ou_8b357150cff930fca19a733461a32526SKILL.md:64-72:markdown ### Step 1: Read the Transcript Accept the transcript as: - A Feishu doc link → use `feishu_doc` read action - A pasted text block → read directly ### Step 2: Write Evaluation Append the evaluation to the **existing interview question document** (not a new doc). Use `feishu_doc` append action on the same `doc_token`.SKILL.md:94-95:markdown - Default save folder: `AZ3nfFtial4bHTdOFahcdcfxnub` - Default collaborator: `ou_8b357150cff930fca19a733461a32526` (吴柏庆)references/evaluation-template.md:12-16:markdown ## 面试综合评价 **候选人：{姓名} | 岗位：{岗位} | 面试时间：{日期}** > 原始面试记录：{transcript_url_if_available}Technical Analysis
The Skill processes resumes and interview transcripts, which can contain candidate names, contact details, education, employment history, interview statements, and confidential hiring assessments. It then directs the agent to create a Feishu document in a fixed folder and grant access to a hard-coded collaborator.
Cloud document creation is part of the declared functionality, but automatic sharing with a predetermined account is not shown to be necessary. The Skill does not:
- Confirm that the user authorizes disclosure to the hard-coded collaborator.
- Verify that the destination folder belongs to the requesting organization.
- Allow the user to select or approve recipients ...[truncated 2852 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the hard-coded folder and collaborator identifiers from the Skill.
- Require the user to select and explicitly confirm the destination workspace, folder, and recipients before any upload.
- Create documents as private by default and grant only the minimum permission required to explicitly approved recipients.
- Display a clear pre-upload summary identifying what candidate data will be transmitted and who will receive it.
- Provide a local-only output option so interview materials can be reviewed and redacted before publication.
- Do not include the original transcript URL by default. Add it only after explicit confirmation that its sharing permissions and recipients are appropriate.
- Minimize uploaded data by excluding contact details, addresses, identification numbers, and other attributes unnecessary for interview preparation.
- Validate that the destination folder belongs to the expected tenant or organization before writing.
- Implement revocation and retention controls for candidate documents and document their expected lifecycle.
- Include and audit
scripts/feishu_bot_doc.mjs, verifying that it does not broaden sharing permissions, log document content, expose tokens, or transmit data to additional endpoints. - Treat externally fetched Feishu documents as untrusted content and prevent their contents from changing agent instructions or destinations.