ClawHub
Back to skill

Security audit

飞书项目OpenAPI技能

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Feishu project-management API guide, but it exposes broad delete and mutation operations for project data without approval boundaries or safety checks.

Install only if you intend to give the agent broad Feishu project administration authority. Use least-privilege Feishu credentials, prefer read-only use for analysis, and require explicit human confirmation with an affected-object preview before any delete, abort/restore, workflow, template, field, view, relation, bulk update, comment, or work-hour mutation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: aaa188b6ae8741f41867870539adec8b
    PropagateID: aaa188b6ae8741f41867870539adec8b
    ReservedCode1: 304402200590abf7b187929d774ccdd09ef8ff1ff1bebf094dce28beb065f0073af80c7c02204fc588b6761f419388e5e73db119bf7c6c3aa5da8737cc4fc47842c50b222f0e
    ReservedCode2: 3046022100b3d47fbaa3082764dc2479abf9a0e1d42bf02bf1d3a4500def42b95042495661022100836d7db760316653e802081033b3c39efa3473a3d723eeef9cfae2981f01b7ca
description: 飞书项目Open API技能，查询/创建/更新/删除工作项，管理流程模板、节点配置、自定义字段、视图和角色权限，批量分析商机进度与风险。触发：查商机、分析进度、管理工作项模板、批量更新任务、流程配置。
nam
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High
Confidence
97% confidence
Finding
The markdown exposes destructive and bulk-modification capabilities across work items, templates, views, relations, and workflow configuration, but does not warn users about irreversible impact or require confirmation steps. In an agent setting, this omission is dangerous because a user may ask for analysis or routine management and the agent could proceed into mass updates or deletions that alter production project data.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 删除工作项
```
DELETE /open_api/{project_key}/work_item/{work_item_type_key}/{work_item_id}
```

### 终止/恢复工作项
Confidence
96% confidence
Finding
The skill includes a direct DELETE endpoint for work items and provides no guardrails around authorization scope, confirmation, validation of target IDs, or recovery expectations. In this context, an agent could be induced to delete the wrong work item through prompt ambiguity, parameter substitution, or social engineering, causing loss of project records and workflow disruption.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 删除流程模板
```
DELETE /open_api/template/v2/delete_template/{project_key}/{template_id}
```

---
Confidence
95% confidence
Finding
The template deletion endpoint allows removal of workflow templates, which can affect future work-item creation and process governance across a project. Because the skill provides this destructive action without safety checks or warnings, an attacker or mistaken user prompt could remove critical process definitions and disrupt operational workflows at scale.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 删除视图
```
DELETE /open_api/{project_key}/fix_view/{view_id}
```

---
Confidence
88% confidence
Finding
Deleting views is less severe than deleting work items, but it can still disrupt team workflows, reporting, and operational visibility if the wrong shared view is removed. The skill does not distinguish personal versus shared/admin views or require confirmation, making accidental or unauthorized deletion more likely.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 绑定/解绑关联工作项
```
POST /open_api/{project_key}/relation/{work_item_type_key}/{work_item_id}/batch_bind
DELETE /open_api/{project_key}/relation/{work_item_type_key}/{work_item_id}
```

---
Confidence
90% confidence
Finding
The relation unbind/delete endpoint can remove associations between work items, potentially breaking traceability, dependency tracking, and downstream reporting. Without validation and confirmation, an agent could sever important project relationships due to ambiguous prompts or maliciously crafted parameters.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill advertises broad trigger phrases such as ‘查商机’, ‘分析进度’, ‘管理工作项模板’, and ‘批量更新任务’ without defining approval boundaries or restricting when destructive actions may be invoked. This increases the chance that normal-language prompts accidentally activate high-risk operations like update, delete, template changes, or bulk modifications without sufficiently explicit user intent.

Static analysis

No suspicious patterns detected.