飞书多维表格权限检查

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate Feishu permission-audit purpose, but it checks access by fetching full document contents, which is broader than users may expect.

Install only if the operator is authorized to audit the Bitable and every linked document. Prefer a version that uses a metadata-only or permission-check endpoint; otherwise assume readable document bodies may be exposed to the agent context, logs, or traces during the check.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:58

Finding

Full Document Retrieval Exceeds the Permission-Checking Purpose

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-61; supporting response definition in references/api_notes.md, lines 20-31
Vulnerability Type: Excessive data access and violation of least privilege
Risk Level: Medium

Vulnerable Code

text

For each link, call `feishu_fetch_doc` to verify read permission:

feishu_fetch_doc(doc_id="<doc_id>")

The documented response confirms that the operation returns the document body:

json

{
  "success": true,
  "message": "Document fetched successfully",
  "doc_id": "xxx",
  "title": "Document title",
  "total_length": 1234,
  "markdown": "..."
}

Technical Analysis

The Skill's declared purpose is to determine whether the current Feishu identity can read each referenced document. This requires only an authorization result or narrowly scoped metadata. Instead, the workflow invokes feishu_fetch_doc, which fetches document blocks and returns the complete document body in the markdown field.

Consequently, sensitive content enters the tool response and Agent execution context even though the final report is intended to include only names, titles, links, and permission status. The instruction to report results only to the owner reduces visible disclosure but does not prevent unnecessary collection or exposure through model context, tool telemetry, execution traces, debugging logs, or downstream processing.

This behavior exceeds the minimum privileges and data access required for the declared functionality.

Attack Path

1. A user supplies a Feishu Bitable URL or application token containing employee names and document links.
2. The Skill reads the Employee Name and Link Address fields and extracts each document token.
3. For every token, the Skill invokes feishu_fetch_doc.
4. For readable documents, the tool retrieves the title, metadata, blocks, and complete Markdown content.
5. The full content enters the Agent/tool execution context despite being unnecessary for ...[truncated 977 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace feishu_fetch_doc with a dedicated Feishu permission-check or metadata endpoint that returns only an authorization status without downloading document blocks.
2. If no suitable API tool exists, implement a narrowly scoped access-check tool that performs the request internally and returns only:
   • Document identifier
   • Authorized/unauthorized status
   • Minimal error classification
   • Title only if strictly required by the output contract
3. Ensure document bodies, block data, and Markdown are discarded before the response reaches the Agent context.
4. Disable or redact sensitive response bodies in application logs, tool traces, telemetry, and error reports.
5. Define how the result recipient is authenticated rather than relying only on the ambiguous term “owner.”
6. Apply explicit batching limits and require confirmation before scanning unusually large tables to reduce the blast radius of accidental data access.
7. Distinguish authorization failures from rate limits, transient network failures, and missing documents so that operational failures are not incorrectly reported as access denial.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is designed to batch-read Bitable records, extract employee names and document URLs, and then probe access to each linked Feishu document, but its description does not clearly warn users that this processing will occur. That creates a consent and privacy transparency gap: users may trigger broad enumeration of internal document access and handling of employee-linked metadata without understanding the scope of data processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents operational instructions and API notes exclusively in Chinese, which can amount to a language/locale policy issue if users are not given an opt-in or alternative. The file does not state that the skill is region-specific or that Chinese is required, so the language restriction appears implicit rather than justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.