T09 · Insecure Skill Coding Practices
Error
- Location
scripts/feishu_token.py:40- Finding
Feishu access and refresh tokens are stored in a plaintext file without enforced restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
feishu-user
Security checks for vulnerabilities and agentic risk
Overview
This Feishu document skill is mostly purpose-aligned, but it handles persistent Feishu credentials and document mutation with weak scoping and safeguards, so it belongs in Review before installation.
Install only if you are comfortable granting this skill access to Feishu documents under your user identity. Prefer reducing OAuth scopes to only what you need, avoid passing app secrets on the command line, protect or remove the cached token file after use, and manually confirm document IDs and block IDs before any update or delete operation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu_token.py:136- Finding
Application secrets are accepted through process arguments and token material is disclosed in terminal output
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:27- Finding
The documented authorization flow requests search permissions not used by the implemented client
- Content
View full analysis
str: """生成授权 URL""" scope = "docx:document drive:drive.search:readonly search:docs:read" params = { "app_id": self.app_id, "redirect_uri": redirect_uri, "state": state or "", "response_type": "code" } query = "&".join([f"{k}={requests.utils.quote(v)}" for k, v in params.items()]) return f"https://accounts.feishu.cn/open-apis/authen/v1/authorize?{query}" ``` ### Technical Analysis The implemented client supports direct document and block operations, but it does not implement cloud-drive search or document search. Consequently, `drive:drive.search:readonly` and `search:docs:read` exceed the permissions needed for the packaged functionality. Broader search scopes increase the usefulness of a stolen token by allowing document discovery and reconnaissance beyond document identifiers already known to the attacker. There is also an implementation inconsistency: `generate_auth_url()` assigns the intended scope string but never inserts `scope` into `params`. Users following the hard-coded documentation receive the broader scopes, while users relying on the script may re ...[truncated 1142 chars]- Remediation
View remediation
other
Note
- Location
scripts/feishu_client.py:74- Finding
The documented overwrite operation silently appends content instead of replacing it
- Content
View full analysis
Dict[str, Any]: """ 写入文档 (覆盖) Args: doc_token: 文档令牌 content: Markdown 内容 Returns: 操作结果 """ # 追加到文档末尾 return self.append_doc(doc_token, content) ``` ### Technical Analysis The method name and documentation represent `write_doc()` as an overwrite operation, but the implementation delegates directly to `append_doc()`. No existing content is removed or replaced. This semantic mismatch can cause callers to believe that stale, incorrect, or sensitive material has been removed when it remains in the document. Repeated calls can also duplicate content and undermine document integrity. ### Attack Path 1. A caller invokes `write_doc()` expecting the existing document to be replaced. 2. The client retrieves the document blocks and appends the supplied content after the final block. 3. Existing content remains intact. 4. The caller assumes the old content was deleted and may share or publish the document. 5. Readers retain access to stale or sensitive information that the caller intended to replace. ### Impact Assessment The issue can cause unintended retention and disclosure of pre-existing document content. It can also produce duplicate or misleading records. Exploitation does not grant additional system or Feishu privileges. The impact is confined to integrity and confidentiality failures in documents on which the caller already has write access. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill is for document read/write operations, but the body also performs OAuth flows, token acquisition/refresh, and local credential caching. This mismatch is dangerous because operators may authorize the skill for simple document editing while overlooking that it can collect, refresh, and persist sensitive credentials.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: feishu-user description: Feishu document operations (User Access Token version). Use user access token for authentication. When you need to read, create, write, or append Feishu documents. --- # Feishishu document operations using useru User
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: feishu-user description: Feishu document operations (User Access Token version). Use user access token for authentication. When you need to read, create, write, or append Feishu documents. --- # Feishishu document operations using useru User
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: feishu-user description: Feishu document operations (User Access Token version). Use user access token for authentication. When you need to read, create, write, or append Feishu documents. --- # Feishishu document operations using useru User
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
The example initializes the client with an inline token placeholder and later instructs users to load tokens from a local config file, normalizing direct handling of bearer tokens in code and local files. In agent settings, this encourages insecure secret handling patterns that can lead to token leakage via source history, logs, prompts, or filesystem exposure.
- Content
client = FeishuClient(user_access_token="u-xxx")
text ## Get User Access Token ### Step 1: Get App Credentials from Feishu Open Platform
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The method is documented as overwriting a document, but it actually appends content by delegating directly to append_doc. In an agent context, this semantic mismatch can cause unintended disclosure, duplication, or corruption of sensitive content because callers may rely on overwrite semantics when handling secrets or replacing stale data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents network access, local file reads/writes, and token persistence, but does not declare any tool scope or permissions boundaries. In an agent environment, this increases the chance the skill will be invoked with broader capabilities than users expect, enabling unreviewed external requests and local credential storage.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text is broad enough that the skill may trigger for many generic document-related requests without clearly constraining when it should access user-scoped Feishu data. Overbroad routing increases the likelihood of unnecessary exposure of personal documents and tokens in contexts where a simpler or read-only action would suffice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 3: Exchange for Token
bash curl -X POST "https://open.feishu.cn/open-apis/authen/v1/access_token" \ -H "Content-Type: application/json" \ -d '{ "grant_type": "authorization_code",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises overwrite, update, append, and delete operations without warning about destructive effects, persistence, or the possibility of modifying the wrong document/block. In an agent-assisted workflow, this can lead to accidental data loss or unauthorized changes to personal cloud documents.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description scopes the skill to reading, creating, writing, or appending Feishu documents. The code additionally exposes block-level retrieval, update, and deletion APIs, including destructive deletion of individual blocks, which is a more granular and broader capability than the stated document operations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } } resp = requests.put(url, json=payload, headers=self.headers) data = resp.json() if data.get("code") != 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code file defines a delete operation that permanently removes a document block via an HTTP DELETE request. Although the docstring names the action as deletion, there is no confirmation prompt, cautionary notice, or explicit warning to the caller about the destructive effect.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as document operations, but this file adds OAuth token acquisition and refresh logic, expanding the capability surface into credential handling and persistence. That mismatch increases security risk because users may not expect the skill to manage long-lived authentication material, making misuse or overscoped access easier to overlook.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code writes access and refresh tokens to a predictable local config file in the user's home directory without any access control hardening or encryption. If the host is multi-user, backed up insecurely, or otherwise compromised, these tokens can be stolen and used to access the victim's Feishu data until revoked or expired.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script posts app_id, app_secret, and auth code to the Feishu token endpoint, which is a sensitive network transmission. This is central to the script's purpose, but there is no explicit disclosure in the usage/help text or docstrings that these secrets will be sent to a remote service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
Tainted flow: 'payload' from requests.post (line 95, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
Tainted flow: 'payload' from requests.post (line 95, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python "app_secret": self.app_secret } resp = requests.post(url, json=payload) data = resp.json() if data.get("code") != 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
At this point the script persists both access and refresh tokens locally without explicit user warning or consent, creating a silent credential retention risk. Refresh tokens are especially sensitive because they can mint new access tokens, so theft of the config file can lead to durable account access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The refresh flow sends refresh_token, app_id, and app_secret to the remote refresh endpoint. While expected for token refresh, the script does not clearly warn in advance that locally stored credentials will be transmitted over the network during this operation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Natural-language guidance in this file is exclusively Chinese, including the module description and usage instructions. Under the stated policy, forcing one language without opt-in or justification can be a locale/language policy issue.
- Content
Static analysis
No suspicious patterns detected.