Feishu Doc Writing

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:32 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Feishu document-writing template, but it tells the agent to grant document access to loosely defined roles without explicit confirmation.

Install only if you are comfortable reviewing and approving every Feishu permission change yourself. Before sharing any generated document, verify exact recipients and access levels, especially for bosses, group members, guests, and sensitive meeting or research content. Consider editing the skill to make documents private by default and require explicit confirmation before granting access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:31
• Finding: Mandatory Assistant Branding Alters Generated Document Authorship## Vulnerability Details **File Location**: `SKILL.md`, lines 31-33 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Low ### Vulnerable Instruction Faithful English translation of the complete affected section: ```markdown ### 5. Author Attribution - Format: `Little Lobster 🦞 × Requester` - Little Lobster 🦞 is the standard attribution for the AI assistant ``` ### Technical Analysis The skill mandates a fixed assistant identity in every generated document without requiring the requester to approve the attribution. This instruction changes the expected output of the document-writing task by introducing persistent branding and an authorship representation unrelated to the document's substantive content. Because the attribution is unconditional, the agent may identify the branded assistant as an author even when the requester expects neutral formatting, has organizational attribution requirements, or does not consider the assistant an author. This represents output manipulation through skill-level instructions rather than code execution. ### Attack Path 1. A user asks the agent to convert source material into a Feishu document. 2. The document-writing skill is activated. 3. The agent loads and follows the mandatory attribution instruction. 4. The agent inserts the fixed assistant identity alongside the requester. 5. The resulting document contains an unwanted or potentially misleading authorship claim without explicit user approval. ### Impact Assessment The issue does not grant system privileges or enable code execution. Its scope is limited to documents generated while this skill is active. It may nevertheless create misleading authorship records, violate organizational attribution policies, or add unwanted promotional branding to internal and external documents.
• Remediation: ## Remediation Suggestions - Remove the unconditional assistant-branding requirement. - Add assistant attribution only when the requester explicitly asks for it. - Obtain confirmation before representing any person or system as a document author. - Derive author names from verified contributors rather than a fixed skill-level identity. - Where attribution is needed for provenance, identify the assistant as a drafting tool rather than a human or organizational author.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:35
• Finding: Unverified Role-Based Sharing Can Grant Excessive Document Access## Vulnerability Details **File Location**: `SKILL.md`, lines 35-39 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Instruction Faithful English translation of the complete affected section: ```markdown ### 6. Permission Rules - **Boss**: full_access - **Group members**: view - **Requester**: edit ``` ### Technical Analysis The skill directs the agent to assign document permissions according to ambiguous social roles rather than verified identities and explicit authorization. In particular, the term “Boss” has no defined identity-resolution or verification procedure but receives `full_access`, the highest listed privilege. The instruction also grants viewing access to every group member without checking whether all members are authorized to access the source material. This violates least-privilege principles. If an agent has access to Feishu document-sharing APIs, resolving the wrong person as the “Boss” could grant that person administrative control over the document. Broad group sharing could also expose meeting content, research, internal discussions, or unpublished data to unrelated or newly added members. ### Attack Path 1. A user asks the agent to convert a group conversation, meeting, or research result into a Feishu document. 2. The skill instructs the agent to configure permissions automatically. 3. An attacker joins the relevant group, is incorrectly identified as the “Boss,” or exploits ambiguity in display names and role descriptions. 4. The agent resolves the attacker or another unintended account to one of the privileged roles. 5. The agent grants `view`, `edit`, or `full_access` without obtaining explicit approval from the document owner. 6. With `view`, the recipient can read information that was not intended for them. With `edit`, they can alter document content. With `full_access`, they may be able to change sharing settings, invite ...[truncated 574 chars]
• Remediation: ## Remediation Suggestions - Create documents as private by default. - Require explicit confirmation from the requester before granting any third party access. - Resolve recipients through immutable, verified account identifiers rather than display names or informal labels such as “Boss.” - Present the proposed recipient list and permission level to the document owner before applying changes. - Apply least privilege: grant `view` unless a verified business requirement justifies `edit` or `full_access`. - Never grant `full_access` automatically; require separate, explicit owner authorization. - Do not treat group membership alone as authorization to access document content. - Record permission assignments in an audit log and provide a mechanism to review and revoke them. - Validate external, guest, and newly added group members before sharing internal or sensitive material.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description says to activate whenever discussion, meeting content, or research results need to be organized into a Feishu document. This is a broad natural-language condition without explicit trigger phrases, scope limits, or exclusion examples, so it could match many ordinary requests and cause unintended invocation.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The document requires the author signature format to include a specific Chinese name and emoji as the AI assistant's unified signature. This imposes a fixed language/branding convention in natural-language output without indicating user opt-in or a justified region-specific requirement.

Static analysis

No suspicious patterns detected.