T09 · Insecure Skill Coding Practices
Error
- Location
index.js:61- Finding
Attacker-Controlled Filename Allows Path Traversal and Arbitrary Local File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
feishuFindDoc
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it can write a downloaded Feishu file outside the chosen output folder if the remote filename contains path traversal characters.
Review before installing. Only run this with least-privilege Feishu credentials and a non-sensitive output directory. The publisher should validate remote filenames, force saves to remain under the selected output folder, avoid overwriting existing files by default, and pin dependencies with a lockfile before broad use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares no explicit tool scope or permissions while it clearly depends on environment-based secrets (
FEISHU_APP_IDandFEISHU_APP_SECRET) and performs file retrieval. That mismatch reduces transparency and policy enforceability, making it easier for an agent or user to invoke a credentialed file-download capability without clear disclosure or restriction.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation does not warn users that it will download files from chat history and requires sensitive Feishu credentials in environment variables. This can lead to uninformed use, accidental exposure of secrets, or retrieval of sensitive files from chat history without adequate operator awareness or consent.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The dependency uses a caret range (^12.0.0), which permits automatic installation of newer minor and patch releases. This weakens build reproducibility and increases supply-chain risk because future upstream changes or a compromised release could be pulled without explicit review.
- Content
json "description": "Find and download files from Feishu chat history by filename.", "main": "index.js", "dependencies": { "commander": "^12.0.0", "@larksuiteoapi/node-sdk": "^1.26.0" }, "bin": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The SDK dependency is specified with a caret range (^1.26.0), allowing npm to resolve to newer compatible releases over time. For a tool that accesses Feishu chat history and downloads files, this expands supply-chain exposure because dependency updates could change behavior or introduce malicious code without direct source modification.
- Content
json "main": "index.js", "dependencies": { "commander": "^12.0.0", "@larksuiteoapi/node-sdk": "^1.26.0" }, "bin": { "feishu-find-file": "./index.js"
Static analysis
No suspicious patterns detected.