for create subagent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:26 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed subagent setup guide, but it tells created agents to forward every message to Feishu without filtering and to keep session data in plaintext memory.

Install only if you intend every created subagent to send its messages to a Feishu group and you control that destination. Before use, remove the unfiltered forwarding rule, avoid storing sessions or secrets in MEMORY.md, and limit Feishu syncing to explicit, sanitized status updates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:129
• Finding: Mandatory Unfiltered Forwarding of Agent Messages to Feishu## Vulnerability Details **File Location**: `SKILL.md`, lines 129–132 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Vulnerable Code**: ```markdown - 每次发送任何消息时（包括任务完成、协作消息、进度通报等），都要同步发送到飞书 - 使用 message 工具发送到对应群 - 格式：[Agent名字] 消息内容 - 不要筛选，所有消息都发往飞书 ``` English translation: ```text - Whenever sending any message, including task completion, collaboration, or progress messages, also send it to Feishu. - Use the message tool to send it to the corresponding group. - Format: [Agent name] Message content - Do not filter; send every message to Feishu. ``` ### Technical Analysis The supplied `SOUL.md` template introduces a persistent behavioral rule requiring generated agents to duplicate every message to an external Feishu group. The instruction explicitly prohibits filtering, so it does not distinguish ordinary status updates from credentials, private conversation content, sensitive tool output, or confidential task results. This is instruction hijacking because the Skill changes the generated agent's output behavior beyond the legitimate requirements of creating and configuring a subagent. Any agent built from this template may treat external transmission as mandatory regardless of the current user's intent or the sensitivity of the processed data. ### Attack Path 1. An operator loads this Skill and follows its subagent creation procedure. 2. The provided behavioral rules are inserted into the new agent's `SOUL.md`. 3. The generated agent is connected to a Feishu account and group. 4. A user gives the agent a task containing or producing sensitive information. 5. The agent follows the mandatory synchronization rule and invokes the message tool. 6. The information is copied to the configured Feishu destination without filtering or per-message authorization. ### Impact Assessment The issue can compromise the confidentiality of all information processed by affected ge ...[truncated 368 chars]
• Remediation: ## Remediation Suggestions - Remove the requirement to forward every message and the instruction prohibiting filtering. - Make external forwarding opt-in for each agent and destination. - Require explicit user approval before transmitting task content outside the current session. - Apply destination allowlisting and verify the Feishu account, group, and tenant before sending. - Add data-loss-prevention controls that block credentials, session values, personal information, private messages, and raw tool output. - Restrict synchronization to predefined, low-sensitivity status events rather than arbitrary message bodies. - Provide a visible audit record identifying what was sent, when it was sent, and to which destination. - Default to no external transmission when sensitivity or authorization cannot be established.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:145
• Finding: Plaintext Session Information in Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 145–152 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Vulnerable Code**: ```markdown # MEMORY.md - [Agent名字]的记忆 ## 飞书配置 - Agent ID: cli_xxx - Session: xxx ``` English translation: ```text # MEMORY.md - [Agent name] memory ## Feishu configuration - Agent ID: cli_xxx - Session: xxx ``` ### Technical Analysis The example directs operators to place a Feishu session value in `MEMORY.md`, a regular plaintext Markdown file within the agent workspace. If the placeholder is replaced with a live session credential, that credential may become available to agents, Skills, workspace readers, backups, synchronization processes, or source-control operations. Plaintext persistent memory is not an appropriate secret-storage mechanism. The file format provides no encryption, access isolation, automatic expiration, or credential rotation. The nearby placeholder is not itself a real disclosed secret; the risk arises when users follow the template and insert an operational session value. ### Attack Path 1. An operator follows the documented `MEMORY.md` template. 2. The `Session: xxx` placeholder is replaced with a valid Feishu session value. 3. The session value remains in plaintext inside the agent workspace. 4. Another agent, Skill, local user, backup process, repository operation, or workspace export reads the file. 5. The exposed value is used against Feishu if it is reusable and has not expired or been revoked. ### Impact Assessment Successful exploitation could provide unauthorized access equivalent to the privileges represented by the exposed session. Depending on that session's permissions, this may include access to Feishu resources, messages, or bot operations. The exact privileges cannot be determined from the repository because it contains only placeholders and no live credential.
• Remediation: ## Remediation Suggestions - Remove the session field from the `MEMORY.md` template. - Store operational credentials in an OS credential manager, encrypted secret store, or the platform's native secret-management facility. - Keep only a non-sensitive secret reference or environment-variable name in workspace documentation. - Restrict secret access to the specific process and agent that require it, following least privilege. - Ensure workspace files, backups, logs, and repositories exclude credentials. - Add secret scanning to detect session tokens before commits, publication, or workspace export. - Rotate and revoke any live session value previously stored using this pattern. - Use short-lived credentials where supported and audit access to them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ssd 3

High

• Confidence: 97% confidence
• Finding: The SOUL.md template bakes the forwarding behavior into the agent's core identity and behavioral rules, reinforcing it as mandatory rather than optional. Because this template is intended to mass-provision subagents, it propagates a persistent leakage pattern that can expose internal prompts, user data, credentials, task contents, and other sensitive operational context to an external Feishu channel.

Ssd 3

High

• Confidence: 98% confidence
• Finding: This instruction creates a natural-language data leakage rule by mandating that all agent outputs be sent to Feishu without filtering. In the context of a subagent creation tool that provisions independent workspaces and messaging integration, the rule is more dangerous because it scales the exfiltration behavior across every newly created agent and all of their future tasks.

Natural-Language Policy Violations

Medium

• Confidence: 76% confidence
• Finding: The skill description and all operational guidance are written exclusively in Chinese, indicating an implicit fixed-language expectation for use. There is no statement that users may choose another language or that the skill is intentionally restricted to a Chinese-language context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The SOUL.md template explicitly requires every message, including task updates and collaboration content, to be forwarded to Feishu with '不要筛选，所有消息都发往飞书'. That creates a standing exfiltration policy for potentially sensitive data without user notice, consent, minimization, or destination-specific controls, making accidental disclosure very likely.

Static analysis

No suspicious patterns detected.