T09 · Insecure Skill Coding Practices
Warning
- Location
MANUAL_PUSH.md:38- Finding
GitHub Access Token Exposed in Command-Line URL
- Content
View full analysis
- Remediation
View remediation
Security audit
File Monitor Feishu Notify
Security checks for vulnerabilities and agentic risk
Overview
The skill’s main purpose is clear, but it should be reviewed carefully because it runs continuously, sends local file notifications to an external Feishu chat, and documents unsafe process and install practices.
Install only if you intentionally want a continuous local folder monitor that sends notifications to a Feishu group. Use a narrowly scoped watch directory, protect config.json because it contains Feishu secrets, restrict who can write the pending notification file, avoid the documented token-in-URL and `npx @latest` commands, and do not use the blanket python.exe kill command to uninstall.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:93- Finding
Unpinned Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
install file-monitor-feishu-notify ``` - Document the expected package publisher and registry. - Where supported, verify package integrity using a lockfile, package-manager integrity metadata, checksum, or signed release. - Prefer a previously installed and organization-approved CLI instead of allowing `npx` to download executable code on demand. - Test and review each new CLI release before updating the documented version. - Use a restricted, non-administrator account or isolated environment for package installation. - Consider directing users to a trusted package-manager configuration that disables unexpected lifecycle scripts when compatible with the installer. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
-
复制公钥：
powershell Get-Content ~/.ssh/id_ed25519.pub | Set-Clipboard
-
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The uninstall instructions use
taskkill /F /IM python.exe, which forcibly terminates all Python processes on the host, not just this skill's components. This can disrupt unrelated applications, background jobs, development environments, or production automation, causing denial of service or data loss.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The file contains contradictory claims about whether the skill actually sends Feishu messages or only writes to a local queue file. This mismatch is dangerous because reviewers and users cannot reliably determine whether the skill performs network exfiltration, which weakens oversight and can hide later-introduced behavior changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The file contains contradictory claims about whether the skill actually sends Feishu messages or only writes to a local queue file. This mismatch is dangerous because reviewers and users cannot reliably determine whether the skill performs network exfiltration, which weakens oversight and can hide later-introduced behavior changes.
- Content
Tainted flow: 'token_req' from open (line 62, file read) → urllib.request.urlopen (network output)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
- Content
python token_req = urllib.request.Request(token_url, data=token_data) token_req.add_header('Content-Type', 'application/json') with urllib.request.urlopen(token_req, timeout=10) as resp: token_result = json.loads(resp.read().decode('utf-8')) if token_result.get('code') != 0:
Tainted flow: 'msg_req' from open (line 82, file read) → urllib.request.urlopen (network output)
High
- Category
- Data Flow
- Confidence
- 83% confidence
- Finding
The script automatically forwards the full contents of a local notification file to an external Feishu chat with no content validation, redaction, approval step, or recipient allowlist enforcement beyond configured chat_id. In this skill context, a file-monitoring automation can unintentionally exfiltrate sensitive local data to a group chat if another process or user can write to the watched file.
- Content
python msg_req.add_header('Content-Type', 'application/json') msg_req.add_header('Authorization', f'Bearer {access_token}') with urllib.request.urlopen(msg_req, timeout=10) as resp: msg_result = json.loads(resp.read().decode('utf-8')) if msg_result.get('code') == 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions tell the user to place a GitHub personal access token directly in the remote URL for
git push. Tokens embedded in command lines can be exposed via shell history, process listings, logs, clipboard history, screenshots, or copied terminal transcripts, which can lead to repository compromise.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises automatic sending of newly detected files to a Feishu group without prominently warning about the privacy and data-exfiltration implications. In this context, the skill's core function is data movement, so lack of explicit disclosure materially increases the chance users will expose sensitive files unintentionally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documented HEARTBEAT watchdog behavior adds process-inspection and restart capability beyond simple file monitoring and Feishu notification. Broadening a skill's operational scope increases trust and abuse risk because it introduces persistence-like behavior and system management actions not clearly necessary for the core function.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run
npx clawhub@latest install, which fetches and executes the latest remote package version without pinning. This creates a supply-chain risk: a compromised or maliciously updated package version could execute arbitrary code on the user's machine during installation.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises automation that reads and writes files, launches PowerShell, and communicates over the network, but it declares no explicit tool scope or permissions. This creates an authorization and review gap: operators cannot easily assess or constrain what the skill is allowed to do before enabling an always-on monitor.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill lacks a prominent warning that it continuously monitors local files and may send resulting information to an external Feishu chat. In this context, silent monitoring plus outbound notification is security-sensitive because users may expose confidential file names or contents, especially when credentials and chat identifiers are preconfigured.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger section says the monitor auto-triggers and HEARTBEAT runs as a daemon, but it does not define precise activation conditions, watched paths, or stop conditions. Ambiguous automatic execution in a persistent background process increases the chance of unreviewed surveillance, unintended repeated actions, and difficulty containing failures.
- Content
Tainted flow: 'LOG_FILE' from open (line 23, file read) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python log_line = f"[{timestamp}] {message}\n" print(log_line, end='', flush=True) try: with open(LOG_FILE, 'a', encoding='utf-8') as f: f.write(log_line) except: pass
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code is explicitly designed to transmit notification content and uses stored application credentials, but it provides no user-facing warning, consent mechanism, or in-code disclosure about external data transmission. In a file-monitor skill, this increases the chance that operators unknowingly send sensitive file contents to a third-party messaging platform.
- Content
Tainted flow: 'NOTIFY_FILE' from open (line 22, file read) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python # 清空通知文件（强制刷新到磁盘） try: with open(NOTIFY_FILE, 'w', encoding='utf-8') as f: f.write("# 待发送通知\n\n_当前没有待发送的通知_\n") f.flush() os.fsync(f.fileno()) # 强制刷新到磁盘
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and all visible status/messages are written only in Chinese, which imposes a specific language on users. The file does not provide any opt-in, fallback, or justification that this skill is intended exclusively for a Chinese-speaking or region-specific environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Natural-language policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified regional limitation. This file presents all user-facing instructions only in Chinese and does not indicate that the language choice is optional or region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file uses a single fixed language throughout and does not mention that the skill or its operational documentation is Chinese-only. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale/language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The skill description and operational guidance are presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The configuration guidance has users store Feishu credentials locally and the README also emphasizes detailed logging, but it does not warn that secrets or file/activity metadata may be exposed through local files and logs. This omission can lead to insecure handling of credentials and sensitive operational data.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Line L122 instructs use of Get-WmiObject Win32_Process to inspect running processes by command line. For a skill whose stated purpose is file monitoring and Feishu notification, querying system-wide process metadata is a broader host-inspection capability and is not obviously necessary from the manifest description alone.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example value for "watch_dir" uses Chinese text ("你的监控目录") as the only illustrated directory name. In a config example, this can imply a language-specific expectation without any opt-in or explanation, which fits the policy category for forced language/locale behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language strings in the module description force a specific language/locale for users and operators, and there is no opt-in or alternative language path. Under the policy, hard-coding a specific language without user choice is a locale-policy issue unless clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.