Security audit

Catfee飞书群聊总结

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can export sensitive Feishu group chat history and participant IDs into persistent documents while relying on an undeclared local helper program that receives credentials.

Install only if you are authorized to export the target Feishu group’s messages. Use a least-privilege Feishu app, verify document sharing settings, confirm the `feishu-docs` CLI source before running it, and clean up any generated `tmp_chat_summary.md` or `chat_summary_*.md` files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The script presents itself as a chat summarizer but actually exports the full chat transcript and user IDs into a remote document, and may also save a local backup. This mismatch can cause users or operators to disclose far more sensitive content than they intended, especially in workplace chat contexts.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The function docstring says it creates and writes a Feishu document, but it also writes sensitive chat content to a local temporary markdown file. That hidden local persistence increases exposure on shared or monitored systems and can surprise operators handling confidential data.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases include broad, conversational language such as '帮我看看这几天', which could match ordinary user requests and invoke the skill unintentionally. Because this skill reads group chat history and exports content into a document, accidental activation can expose sensitive conversation data and participant identifiers without sufficiently explicit user intent.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill description states that it pulls group messages, generates full chat records including sender ID, nickname, timestamp, and content, and creates a Feishu document, but it does not clearly warn users that this exports potentially sensitive communications and participant identifiers into a new persistent artifact. In this context, the missing warning materially increases privacy and data-governance risk because users may not realize the scope of collection, retention, and redistribution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script retrieves member and message data, then publishes derived and full chat content to external Feishu services without an explicit warning or consent flow. In a skill context, that makes accidental bulk disclosure more likely because users may assume only local summarization occurs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code writes the assembled chat summary and full transcript to a local markdown file as part of document publishing, and on failure stores a timestamped backup. Unannounced local persistence of potentially sensitive chat logs raises confidentiality risk on multi-user machines, developer laptops, and CI/automation hosts.

Static analysis

No suspicious patterns detected.