T09 · Insecure Skill Coding Practices
Warning
- Location
config.local.json:2- Finding
Packaged Feishu Resource Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
AccountingOnFeishu
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Feishu bookkeeping assistant, but it needs review because it handles sensitive financial records while bundling real-looking Feishu table identifiers and under-disclosing record sampling, local storage, and external receipt OCR.
Review this skill before installing. Use a Feishu table you control, remove or replace any bundled config.local.json identifiers, confirm what data the agent will read before initialization, and avoid sending receipt images unless you are comfortable with temporary local storage and external vision processing.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:67- Finding
Excessive Retrieval of Existing Financial Records During Initialization
- Content
View full analysis
list - app_token: - table_id: - page_size: 20 ``` ### Technical Analysis The initialization workflow directs the Agent to retrieve up to 20 complete records from an existing accounting table to learn the user's categorization habits. Accounting records can contain sensitive transaction descriptions, amounts, dates, income information, merchants, and personal notes. The Skill's persisted configuration contains field mappings and category option values. Those values can generally be derived from table-field metadata without reading complete transaction records. Automatically retrieving 20 records therefore exceeds the minimum data required for basic schema discovery. The instructions do not require informed consent specifically for reading transaction history, field-level filtering, redaction, or deletion of sample data from Agent context after analysis. ### Attack Path 1. A user provides a Feishu accounting-table link or its app token and table ID. 2. The Agent lists the table fields as expected. 3. The Agent additionally invokes the record-list operation with a page size of 20. 4. Complete sample transactions are returned to the Agent's processing context. 5. Sensitive descriptions, amounts, and other fields are processed even when only field names and category options were necessary. 6. Any logging, model processing, or tool telemetry associated with the Agent may consequently receive more financial information than required. ### Impact Assessment The workflow can expose up to 20 financial records per initialization to the Agent and its associated processing environment. The issue does not establish access beyond the Feishu permissions already granted to the Agent, but it unnecessarily broadens the amo ...[truncated 245 chars]- Remediation
View remediation
other
Warning
- Location
SKILL.md:242- Finding
Receipt Images Sent to an External Vision Processor Without Explicit Consent Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README highlights convenience features but does not prominently warn users that first use may read their existing Feishu bookkeeping base and persist learned structure locally in a config file. This is a meaningful transparency and privacy issue because users may provide a Feishu link without understanding that historical financial metadata will be analyzed and retained on disk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The initialization trigger phrase is extremely generic (effectively '我要记账' / 'I want to keep accounts'), which is likely to appear in normal conversation and can invoke the skill without strong user intent confirmation. In a skill that reads existing Feishu bookkeeping data and may create or modify records, broad activation increases the risk of unintended access to financial data or accidental writes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description, examples, prompts, field names, and responses are all specified in Chinese, and the trigger section only describes Chinese utterances. Under the policy, a skill should not impose a specific language or locale unless it offers opt-in or clearly documents a justified region-specific constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly persists Feishu app tokens, table identifiers, and learned bookkeeping structure into a local
config.json, but does not clearly warn users in the user-facing description that sensitive financial metadata and access credentials are stored on disk. This creates a privacy and credential-exposure risk if the local environment is shared, backed up insecurely, or later accessed by another skill or process.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
B2. 创建多维表格
text feishu_bitable_app > create - name: "个人记账本"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
B2. 创建多维表格
text feishu_bitable_app > create - name: "个人记账本"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill downloads receipt images to local temporary storage for OCR processing, but it does not warn users that potentially sensitive receipts containing merchant names, timestamps, itemized purchases, and payment-adjacent data will be written to disk. Temporary local storage increases the chance of unintended retention, forensic recovery, or exposure to other local users or processes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This manifest-style JSON defines the table name, field names, type labels, categories, and review options entirely in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no justification or alternative locale support is documented in the file.
- Content
Static analysis
No suspicious patterns detected.