T09 · Insecure Skill Coding Practices
Error
- Location
scripts/save_to_feishu.py:66- Finding
Unrestricted URL Fetching Enables SSRF and Secondary Data Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
WeChat Article Parser - 微信公众号文章解析
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its article-parsing purpose, but its Feishu save path can automatically alter table schema, read all records, and batch-delete rows without clear user control.
Review this skill before installing. Use the local parser only for public article URLs you trust, and do not enable Feishu saving unless you are comfortable granting the configured app broad table read/write permissions. Avoid pointing it at shared or important Feishu tables until the automatic field creation and blank-row deletion behavior is removed or gated behind explicit confirmation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/save_to_feishu.py:220- Finding
Article Save Operation Performs Unrelated Destructive Table-Wide Cleanup
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/save_to_feishu.py:180- Finding
Normal Save Workflow Silently Performs Privileged Table Schema Changes
- Content
View full analysis
0: print(f" 📋 Created {created_count} new fields") else: print(f" 📋 All fields are ready") ``` ```python # scripts/save_to_feishu.py:320-321 # Automatically check for and create missing fields. ensure_fields_exist(token) ``` ### Technical Analysis Every article-save request first checks the target table schema and automatically creates any missing fields. Creating ...[truncated 1639 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (34)
Tainted flow: 'data' from os.getenv (line 32, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "app_secret": APP_SECRET } response = requests.post(url, headers=headers, json=data) result = response.json() if result.get("code") == 0:
Tainted flow: 'api_url' from os.getenv (line 360, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python api_url = f"https://open.feishu.cn/open-apis/bitable/v1/apps/{APP_TOKEN}/tables/{TABLE_ID}/fields" headers = {"Authorization": f"Bearer {token}"} response = requests.get(api_url, headers=headers) result = response.json() if result.get("code") == 0:
Tainted flow: 'api_url' from os.getenv (line 360, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python created_count = 0 for field_name, field_def in required_fields.items(): if field_name not in existing: response = requests.post(api_url, headers=headers, json=field_def) result = response.json() if result.get("code") == 0: created_count += 1
Tainted flow: 'api_url' from os.getenv (line 360, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python if page_token: params["page_token"] = page_token response = requests.get(api_url, headers=headers, params=params) result = response.json() if result.get("code") != 0:
Tainted flow: 'delete_url' from os.getenv (line 287, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # 飞书批量删除最多500条 for i in range(0, len(empty_ids), 500): batch = empty_ids[i:i+500] response = requests.post(delete_url, headers=delete_headers, json={"records": batch}) delete_result = response.json() if delete_result.get("code") == 0: print(f" 🗑️ 批量删除 {len(batch)} 个空白行")
Tainted flow: 'api_url' from os.getenv (line 360, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "fields": fields } response = requests.post(api_url, headers=headers, json=data) result = response.json() if result.get("code") == 0:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
复制配置模板：
bash cp .env.example .env编辑
.env文件：
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose is limited to parsing WeChat public-article content, but the analyzed behavior reportedly includes handling unrelated domains, modifying Feishu table schema, and deleting blank rows. Hidden write and deletion capabilities are security-relevant because users may authorize a benign parser while unknowingly granting a tool that can alter or destroy external data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented purpose is limited to parsing WeChat public-article content, but the analyzed behavior reportedly includes handling unrelated domains, modifying Feishu table schema, and deleting blank rows. Hidden write and deletion capabilities are security-relevant because users may authorize a benign parser while unknowingly granting a tool that can alter or destroy external data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python import os from dotenv import load_dotenv # 加载 .env 文件 load_dotenv() APP_ID = os.getenv("FEISHU_APP_ID", "")
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The implementation does more than save an article: it modifies Feishu table schema and deletes existing rows it considers 'empty'. Those destructive side effects exceed the stated skill purpose and can cause unintended data loss in a user's existing table, making the mismatch particularly dangerous in this context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to save parsed article data to Feishu but does not clearly disclose that article content, links, summaries, and related metadata will be transmitted to a third-party cloud service. This can lead to unintended data exposure, especially if users process private, sensitive, or copyrighted material and assume the tool operates only locally.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises executable behaviors involving environment variables, file writes, network access, and shell commands, but it does not declare any explicit tool scope or permissions boundaries. This is dangerous because reviewers and runtime policy systems cannot easily determine or constrain what the skill may access, increasing the chance of unintended data exposure or unauthorized side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes a save-to-Feishu feature but does not clearly warn users that article content may be transmitted to a third-party service. This is dangerous because users may share copyrighted, private, or sensitive article data without informed consent, creating privacy, compliance, and data-handling risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "app_secret": APP_SECRET } response = requests.post(url, headers=headers, json=data) result = response.json() if result.get("code") == 0:
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to target WeChat article parsing, but the code intentionally processes links from multiple unrelated platforms. This scope expansion increases privacy and consent risk because users and reviewers may expect a narrower data-handling boundary than the implementation actually enforces.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill invokes an external CLI tool to fetch content, which introduces extra execution capability and trust in whatever binary is present in the runtime environment. In an agent skill advertised as article parsing, this hidden dependency broadens the attack surface and makes behavior less auditable.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--max-chars", "5000" ] result = subprocess.run( cmd, capture_output=True, text=True,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python created_count = 0 for field_name, field_def in required_fields.items(): if field_name not in existing: response = requests.post(api_url, headers=headers, json=field_def) result = response.json() if result.get("code") == 0: created_count += 1
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This external request performs batch deletion of Feishu records. The danger is not merely that data leaves the system, but that the code can irreversibly delete user data based on a weak 'empty row' heuristic, which is especially unsafe for a skill whose description only mentions optional saving.
- Content
python # 飞书批量删除最多500条 for i in range(0, len(empty_ids), 500): batch = empty_ids[i:i+500] response = requests.post(delete_url, headers=delete_headers, json={"records": batch}) delete_result = response.json() if delete_result.get("code") == 0: print(f" 🗑️ 批量删除 {len(batch)} 个空白行")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sends article URL, title, summary, and full content to Feishu without any explicit consent gate or warning at the point of transfer. In this skill context, users may believe the tool only parses content locally, so undisclosed third-party transmission creates a meaningful privacy and data-governance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The code uploads extracted article content and metadata to Feishu, which is expected for a save feature but still security-relevant because it transfers potentially sensitive content off-box. In this skill context, it becomes a true issue when done without explicit notice and consent, especially since full article bodies are included.
- Content
python "fields": fields } response = requests.post(api_url, headers=headers, json=data) result = response.json() if result.get("code") == 0:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The parser accepts any URL and passes it directly to requests.get without validating that it belongs to mp.weixin.qq.com. In an agent setting, this can be abused for SSRF-style network access, unintended requests to internal services, or fetching attacker-controlled content under the guise of article parsing.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes parsing WeChat articles and optionally saving results to a Feishu spreadsheet, but this file implements saving parsed article data to an arbitrary local JSON file. Local filesystem export is a broader behavior than the stated destination-specific save capability in the manifest.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
A language or locale policy issue can arise when a skill experience is effectively constrained to a single language without opt-in or justification. This quickstart presents all user-facing instructions in Chinese and does not mention whether Chinese is required, optional, or specific to a regional audience.
- Content
Static analysis
No suspicious patterns detected.