T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/mapping-api.js:79- Finding
Unauthenticated User Registration Allows Identity Mapping Takeover
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Agent Relay - Multi-Bot Collaboration
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its Feishu relay purpose, but its user identity mapping can be spoofed or overwritten and it persists sensitive routing identifiers with weak controls.
Review before installing. Use only in a tightly controlled internal or personal Feishu workspace, restrict bot visibility to intended users, do not rely on manual User ID entry for real identity, lock single-user mode to a verified owner open_id, protect user-mapping.json with restrictive permissions, and add authentication, audit logging, and safer storage before production use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/single-user-setup.md:111- Finding
Single-User Mode Permits Owner Mapping Replacement by Any Reachable User
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/single-user-setup.md:413- Finding
Sensitive Identity Mapping Is Stored with World-Readable Permissions
- Content
View full analysis
setTimeout(r, 100 * (i + 1))); } } } // Write the mapping async function writeMapping(data) { for (let i = 0; i < MAX_RETRIES; i++) { try { await fs.promises.writeFile(MAPPING_FILE, JSON.stringify(data, null, 2), 'utf-8'); return; } catch (err) { if (i === MAX_RETRIES - 1) throw err; await new Promise(r => setTimeout(r, 100 * (i + 1))); } } } ``` ### Technical Analysis The mapping file contains universal user identifiers, names, first-seen and last-active timestamps, and Bot-specific Feishu `open_id` values. The troubleshooting instructions explicitly recommend mode `0644`, which gives every local account read access. The implementation stores the information as unencrypted JSON and does not enforce a restrictive mode when creating or rewriting the file. Its effective permissions therefore depend on preexisting permissions and the process umask. ### Attack Path 1. An attacker obtains access to any low-privilege account or co-tenant process on the host. 2. The attacker locates `user-mapping.js ...[truncated 740 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mapping-api.js:27- Finding
Non-Atomic Read-Modify-Write Operations Can Corrupt or Lose Identity Mappings
- Content
View full analysis
setTimeout(r, 100 * (i + 1))); } } } async function writeMapping(data) { for (let i = 0; i < MAX_RETRIES; i++) { try { await fs.promises.writeFile(MAPPING_FILE, JSON.stringify(data, null, 2), 'utf-8'); return; } catch (err) { if (i === MAX_RETRIES - 1) throw err; await new Promise(r => setTimeout(r, 100 * (i + 1))); } } } ``` ```javascript async function updateBotOpenId(userid, agentId, openId, name = null) { const mapping = await readMapping(); mapping.users = mapping.users || {}; if (!mapping.users[userid]) { mapping.users[userid] = { botOpenIds: {}, name: name || userid, firstSeen: new Date().toISOString(), lastActive: new Date().toISOString() }; } mapping.users[userid].botOpenIds[agentId] = openId; mapping.users[userid].lastActive = new Date().toISOString(); if (name) mapping.users[userid].name = name; mapping.updatedAt = new Date().toISOString(); await writeMapping(mapping); return true; } ``` ### Technical Analysis The update operation reads the entire JSON document, modifies an in-memory copy, and rewrites the entire file. No inter-process lock, transaction, compare-and-swap version, or serialization mechanism protects this sequence. Retrying failed reads or writes does not prevent two Agents from reading the same old state and then overwriting one another. In addition, writing directly to the dest ...[truncated 1190 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
references/feishu-bot-setup.md:190- Finding
Unpinned Global Installation of a Third-Party Package Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `relay-examples.md` - Code examples
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
Get user's open_id for a specific Bot.
Use case: Specialist wants to send message to user.
javascript const openId = await mapping.getBotOpenId('user_demo_001', 'product-expert');
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
In your Agent workspace, create
.envfile:bash # /path/to/workspace-coordinator/.env DEPLOYMENT_MODE=single-user
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The README explicitly states that multi-user mode relies on manual User ID entry with no verification, which creates an insecure identity-binding mechanism. In a bot relay system that enables cross-bot routing and proactive messaging, an attacker could register another user's ID or impersonate identities, leading to unauthorized message access, spoofed communications, and privacy breaches across agents.
- Content
md ### Limitations - Manual User ID entry in multi-user mode (no verification) - Requires multiple Feishu Bot applications - Internal/enterprise use only
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill repeatedly instructs users and bots to communicate in Chinese (for example, registration flows use only Chinese prompts) and does not state that this skill is limited to a Chinese-speaking or Feishu-specific locale. Because no opt-in, language selection, or justification is provided, this creates a natural-language locale policy concern.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
The skill explicitly documents a registration flow that accepts a user-supplied User ID with no verification, enabling impersonation of other users. In a multi-bot relay architecture, a spoofed identity can cause messages, tasks, and potentially sensitive responses to be routed under the wrong user identity across agents.
- Content
text User → Bot: "你好" Bot → User: "请告诉我您的 User ID（工号/用户名）" User → Bot: "我的 user ID 是：user_demo_001" ← ⚠️ MANUAL STEP - NO VERIFICATION⚠️ Risks:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
This section repeats and operationalizes the insecure design: users provide arbitrary IDs and the system trusts them. Because the mapping is later used for coordinator-to-specialist relay and proactive DMs, an attacker can register as another person and receive or influence communications intended for that victim.
- Content
User → Bot: "我的 user ID 是：zhangsan"
text **⚠️ Security Warning:** Manual User ID entry has NO verification. Internal use only! 📖 **Full guide:** [references/feishu-bot-setup.md](references/feishu-bot-setup.md)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Don't use for:** - ❌ Single-Bot scenarios - ❌ Production without verification (multi-user) - ❌ External-facing applications ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Don't use for:** - ❌ Single-Bot scenarios - ❌ Production without verification (multi-user) - ❌ External-facing applications ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Multi-User Mode ⚠️ - Manual ID entry (no verification) - Identity spoofing possible - **Internal use only** - **Add verification for production**
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The setup hard-codes Chinese app names, descriptions, bot bios, and later conversational examples and SOUL instructions in Chinese, implying the deployed skill will operate in that language by default. The document does not offer users or deployers a language/locale choice or explain that the locale restriction is required for a region-specific use case.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide explicitly instructs operators to collect user-provided User IDs and store per-bot open_id mappings in a shared JSON file, but it does not require notice, consent, minimization, retention limits, or access controls as part of the registration flow. Because these identifiers enable cross-bot correlation of individual users, misuse, overexposure, or unauthorized access could leak internal identity relationships and create privacy/compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This is a markdown file, so SQP-2 applies to omissions in warnings about behaviors affecting user data or privacy. The API reference explicitly exposes a function to list all users and earlier sections document storage of names, IDs, bot-specific open_ids, and activity metadata, but the document provides no warning or privacy notice about access sensitivity or appropriate handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example hard-codes the date format to 'zh-CN', which imposes a specific locale in user-facing output. The file does not indicate that the user can choose a language or that the locale restriction is required for a documented regional purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide instructs automatic registration on first contact and storage of bot-specific identifiers in a mapping table without clearly warning users that their identifiers will be persisted. In contexts where others may message the bot, this can lead to silent collection and retention of identifiers without informed consent or clear operator awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document defines agent names in Chinese and later demonstrates interaction entirely in Chinese, such as the required contact and relay phrases. This creates a natural-language locale constraint for use of the skill, but the guide does not state that Chinese is optional or provide an alternative language path.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ls -la /path/to/workspace/user-mapping.json # Should be writable chmod 644 /path/to/workspace/user-mapping.json # Check mapping API path cat /path/to/workspace/mapping-api.js | grep MAPPING_FILE
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide explicitly claims there is no identity spoofing risk, but the documented logic auto-binds the hardcoded user identity "me" to whichever account contacts the bot first and even updates that binding if the open_id changes later. This creates an authorization flaw: any unintended or unauthorized first contact, or any later message from a different account, can seize the single-user identity and receive relayed bot output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code writes user mapping data to user-mapping.json, which affects persisted user data. Although there is an internal comment, there is no confirmation prompt, logging/print statement, or other user-facing disclosure that the skill will modify stored mapping records.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language documentation and usage guidance in this file are presented exclusively in Chinese. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint can be a policy violation.
- Content
Static analysis
No suspicious patterns detected.