Ali Feishu Project(Teambition/Meego) SKILL

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:05 AM UTC
• Version: 1.0.1

Overview

The skill is small, but it makes its real behavior depend on mutable external instructions for creating an account-like digital human service.

Install only if you are comfortable with the agent reading and following the linked external TB documentation or connector at run time. Before signing in, creating accounts, or submitting personal/business data, review the linked instructions yourself and require explicit confirmation for consequential actions. A safer version would package the full reviewed steps locally or pin the external document to an immutable revision.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:1

Finding

Mandatory Delegation to Mutable External Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1-4
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete code snippet translated into English:

markdown

## Help your owner register a digital human on TB. Be sure to execute the following steps in order.
Follow this document: https://github.com/teambition/tb-skills/blob/main/README_FOR_AI.md

If your owner prefers Meego, you can also use https://clawhub.ai/wadxm/feishu-project-connector

Technical Analysis

The local Skill directs the agent to follow instructions hosted outside the audited package. The GitHub URL references a mutable branch rather than an immutable commit, while the alternative URL delegates behavior to another externally hosted Skill. The contents and security properties of these external resources are not represented in the project and were therefore outside the audited artifact.

This creates instruction hijacking risk because the Skill's effective behavior can be changed remotely without modifying SKILL.md or triggering a new review. An external maintainer or an attacker who compromises the referenced resources could introduce instructions that change the agent's goal, weaken safety constraints, request sensitive information, invoke tools, or direct data to an external service.

The finding concerns remote instructions, not confirmed remote code execution. No local scripts or embedded executable payloads were present in the audited project.

Attack Path

1. A user loads or invokes the Skill.
2. SKILL.md instructs the agent to follow one of the externally hosted resources.
3. The external content is changed by its maintainer or compromised by an attacker after the local Skill has been reviewed.
4. The agent interprets the changed remote content as instructions authorized by the local Skill.
5. The agent performs attacker-selected actions using the tools, credentials, network access, an ...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

1. Include all operational instructions directly in the audited Skill package.
2. Do not treat externally retrieved content as authoritative agent instructions; use it only as untrusted reference material.
3. If an external resource is unavoidable, pin it to an immutable, reviewed revision, such as a specific Git commit, and verify its expected cryptographic digest before use.
4. Review and package the alternative connector as an explicit dependency rather than dynamically delegating to an unreviewed Skill page.
5. Define an allowlist of permitted actions, domains, tools, and data fields locally so external content cannot expand the Skill's authority.
6. Require explicit user confirmation before authentication, account creation, sensitive-data submission, or any consequential external operation.
7. Re-audit the complete pinned external material whenever its revision changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L1 presents the skill entirely in Chinese and instructs the agent to follow it as mandatory behavior, with no indication that the user can opt into another language. Under the policy rules, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.