T08 · Insecure Dependencies
Warning
- Location
feishu-docx-download/extract.js:21- Finding
Runtime Installation of Unpinned npm Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
feishu-skills
Security checks for vulnerabilities and agentic risk
Overview
This Feishu skill pack is not clearly malicious, but it needs review because it enables broad Feishu data access and mutation through local command execution with persistent credentials.
Install only if you are comfortable giving this skill pack broad Feishu access and letting it run local Node commands. Review Feishu app scopes, keep exec prompting or sandboxing enabled where possible, protect and rotate app secrets, delete stale config backups, and preinstall or pin document parser dependencies before using file extraction.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
feishu-quick-setup/quick-setup.js:220- Finding
Feishu Application Secret and Backup Written Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (225)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The README confirms long-lived access via locally stored access and refresh tokens, enabling persistent credential reuse for Feishu operations. If the host or token directory is compromised, an attacker could act as the user across documents, chat, calendar, tasks, and other connected Feishu resources until revocation or expiry.
- Content
md 6. Token is saved; future calls are transparent **Token lifecycle:** - Access tokens auto-refresh via refresh token (no re-auth needed) - Tokens are stored per user (`open_id`) per app (`appId`) - Re-auth only needed if refresh token expires (~30 days of inactivity)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 6. Token 保存后，后续调用对用户完全透明 **Token 生命周期：** - Access Token 通过 Refresh Token 自动续期，无需重新授权 - Token 按用户（`open_id`）和应用（`appId`）分别存储 - 仅在 Refresh Token 过期时（约 30 天不活跃）需要重新授权
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Operating on Feishu Wiki resources with per-user OAuth tokens is not equivalent to installing skills, and it may permit access to or mutation of internal knowledge-base content. The mismatch is particularly dangerous because knowledge bases often contain broad organizational information beyond what a user expected to expose during installation.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Always run `install.mjs` (or `install.js`) to complete the installation; do not copy skill directories manually.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Always run `install.mjs` (or `install.js`) to complete the installation; do not copy skill directories manually.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- feishu-docx-download/extract.js:29
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- feishu-docx-download/extract.mjs:32
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/auth.js:318
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/auth.mjs:320
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/send-card.js:124
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/send-card.mjs:126
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/token-utils.js:41
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-auth/token-utils.mjs:43
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-docx-download/download-doc.js:42
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- feishu-docx-download/download-doc.mjs:44
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-auth/auth.js:211
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-auth/auth.mjs:213
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-auth/token-utils.js:129
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-auth/token-utils.mjs:131
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-quick-setup/quick-setup.js:218
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- feishu-quick-setup/quick-setup.mjs:220
Instructions pass high-value credentials through process argv.
Critical
- Code
- suspicious.secret_argv_exposure
- Location
- feishu-wiki/SKILL.md:55