Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Feishu API helper skill, but it can use powerful Feishu tokens to read or change live documents.
Install only if you intend to let an agent call Feishu MCP APIs. Use least-privilege UAT/TAT scopes, restrict X-Lark-MCP-Allowed-Tools to the needed tools, avoid pasting real secrets into shared chats or logs, and confirm before creating, updating, or commenting on live documents.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 🔐 认证方式
### User Access Token (UAT)
代表用户身份，适用于需要模拟特定用户操作的场景。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 🔐 认证方式
### User Access Token (UAT)
代表用户身份，适用于需要模拟特定用户操作的场景。
The authentication and initialization examples show sending UAT/TAT tokens and document-related requests to remote Feishu endpoints over network APIs without a clear privacy or data-transmission warning. In a skill meant for agent use, users may not realize that access tokens, user search terms, document identifiers, and document contents are transmitted to an external service, increasing the risk of accidental disclosure of sensitive enterprise data.
This code sends authenticated requests to an external Feishu MCP endpoint. External transmission is expected for the skill's purpose, but it still represents a real security concern because credentials and request data leave the local environment and may include sensitive enterprise content or identifiers.
"method": "initialize" }
response = requests.post(url, headers=headers, json=payload) result = response.json() print(json.dumps(result, indent=2))
The tools/list request transmits authenticated metadata to a remote service, confirming network egress and remote dependency. Although lower risk than content upload, it still exposes the existence of an integration session and uses privileged headers that should be treated sensitively in agent workflows.
"method": "tools/list"
}
response = requests.post(url, headers=headers, json=payload)
tools = response.json()["result"]["tools"]
for tool in tools:
print(f"工具名：{tool['name']}")
The skill provides concrete examples for creating and updating Feishu documents, which are write operations against remote user or tenant data, but it does not clearly warn that these actions will modify live resources. In an agent context, this can lead to unintended document creation, alteration, or spammy writes if a user or downstream system invokes the examples without understanding they are state-changing.
This example performs a remote tools/call operation that can transmit document content to Feishu and may trigger state-changing actions. In context, the danger is elevated because the same skill demonstrates write-capable operations, so external transmission is not just informational but can directly modify or disclose enterprise data.
} }
response = requests.post(url, headers=headers, json=payload) result = response.json() print(json.dumps(result, indent=2))
This code posts app_id and app_secret to retrieve a tenant access token, meaning highly sensitive credentials are used in a network exchange and the response returns a bearer token that can grant broad tenant-level access. In an agent or sample-code setting, this is dangerous if operators paste secrets directly into scripts, logs, notebooks, or chat environments where they may be exposed or reused insecurely.
"app_id": app_id,
"app_secret": app_secret
}
response = requests.post(url, json=payload)
return response.json()["tenant_access_token"]
# 使用
The title, description, examples, and invocation guidance are all written as Chinese-only instructions, and the file does not indicate that users may interact in other languages or that the locale restriction is required for compliance or region-specific operation. This can be a natural-language policy issue when a specific language is effectively imposed without opt-in.
No suspicious patterns detected.