Feishu Knowledge Ingest

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it overstates its Feishu ingestion capability and can persist sensitive document summaries into reusable knowledge artifacts without enforcing its own redaction rule.

Install only if you are comfortable reviewing local output files before reuse. Use a dedicated output directory, do not ingest documents containing secrets unless you add redaction or manual review, and treat MEMORY.candidate.md as untrusted draft content rather than approved agent memory. Expect the included runner to handle only local directories unless a separate Feishu connector is added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: run.py:24

Finding

Untrusted Document Content Is Persisted Without Sensitive-Data Filtering

Content

View full analysis

Vulnerability Details

File Location: run.py, lines 24-103
Vulnerability Type: Unfiltered persistence of untrusted and potentially sensitive document content
Risk Level: Medium

Vulnerable Code

python

def summarize_text(text: str, max_len: int = 220) -> str:
    clean = ' '.join(text.split())
    return clean[:max_len] + ('...' if len(clean) > max_len else '')

python

return {
    'batch_id': batch_id,
    'source_file': path.name,
    'source_token': '',
    'file_type': file_type,
    'topic': path.stem,
    'content_type': detect_content_type(path.name),
    'summary': summarize_text(text),
    'extracted_at': utc_now(),
    'confidence': 0.8,
}

python

f.write('## Successful extraction summary\n')
for row in successes:
    f.write(f"- {row['source_file']}: {row['summary']}\n")

python

mem = output_dir / 'MEMORY.candidate.md'
with mem.open('w', encoding='utf-8') as f:
    f.write('# MEMORY Candidate\n\n')
    f.write(f'- batch_id: {batch_id}\n')
    f.write(f'- started_at: {started_at}\n')
    f.write(f'- finished_at: {finished_at}\n')
    f.write(f'- source_directory: {source_dir}\n\n')
    f.write('## Candidate summaries\n')
    for row in successes:
        f.write(f"### {row['source_file']}\n")
        f.write(f"- topic: {row['topic']}\n")
        f.write(f"- content_type: {row['content_type']}\n")
        f.write(f"- summary: {row['summary']}\n")
        f.write(f"- confidence: {row['confidence']}\n\n")

Technical Analysis

Text extracted from an attacker-controlled or otherwise untrusted DOCX/PDF file is normalized and copied directly into kb-items.jsonl, ingest-report.md, and MEMORY.candidate.md. The implementation does not detect or redact credentials, access tokens, personal information, or other sensitive content before persistence.

This also conflicts with the safety requirement in SKILL.md that s ...[truncated 1805 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a sensitive-data filtering stage before constructing summaries or writing any output.
2. Detect and redact common credential patterns, including API keys, bearer tokens, private keys, passwords, and connection strings.
3. Add configurable PII detection for email addresses, phone numbers, government identifiers, and organization-specific sensitive fields.
4. Mark extracted document content explicitly as untrusted data and prevent downstream workflows from interpreting it as agent instructions.
5. Require explicit human approval before promoting any candidate content into persistent memory.
6. Store outputs with restrictive filesystem permissions and document their retention and deletion policy.
7. Record that redaction occurred without copying the original sensitive value into logs or failure details.
8. Add tests using documents containing representative secrets and prompt-like text to verify that generated artifacts remain sanitized.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependencies Are Unpinned and Not Integrity-Locked

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2
Vulnerability Type: Uncontrolled dependency version resolution
Risk Level: Low

Vulnerable Code

text

python-docx
pypdf

Technical Analysis

Both dependencies are declared without exact versions or package hashes. Consequently, separate installations can resolve to different releases. A future compromised, malicious, or unexpectedly incompatible release could therefore enter the environment without any change to the audited project.

The package names observed are established names rather than evident typosquatting or dependency-confusion identifiers, and the repository does not contain installation scripts that select an untrusted package index. Therefore, this is a supply-chain hardening weakness rather than evidence that a malicious dependency is currently present.

Attack Path

1. A user installs the project dependencies from requirements.txt.
2. The package resolver selects whatever versions are currently permitted by the package index.
3. A newly released, compromised, or incompatible version is downloaded because no reviewed version or hash is enforced.
4. Dependency code executes during installation, import, or document parsing with the privileges of the user running the application.

Impact Assessment

Exploitation depends on an upstream dependency or package-distribution compromise. If that occurs, malicious dependency code could run with the same operating-system privileges as the installer or ingestion process. This could affect the confidentiality and integrity of documents processed by the application and any files accessible to that account.

No current malicious package, remote payload retrieval logic, or privilege-escalation mechanism was identified in the audited repository.

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version.
2. Generate a lock file containing cryptographic hashes, such as a hash-locked requirements file produced through pip-tools.
3. Install with hash verification enabled, for example using pip install --require-hashes.
4. Use only an approved package index and explicitly configure trusted sources in the build environment.
5. Add automated dependency vulnerability scanning and controlled update review.
6. Rebuild the lock file only through a documented process that reviews release notes, provenance, and security advisories.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill claims Feishu folder and shared-file ingestion, attachment classification, and controlled report-first behavior, but the detected implementation reportedly only processes a local top-level input directory and lacks actual Feishu or single-file handling. This mismatch is dangerous because users may trust the skill with sensitive ingestion workflows under false assumptions, causing incomplete coverage, missed files, incorrect provenance, or silent failure of expected safety boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill describes workflows that create multiple output files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens operator visibility and policy enforcement because a runtime may permit file writes without a clear, reviewable declaration of what paths or write capabilities are intended.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes the skill as handling both 'feishu folders and single attachments', but the CLI requires --input-dir and iterates over input_dir.iterdir(), never accepting a single file path as input. This is a semantic mismatch in the advertised scope versus the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill extracts document text and writes summaries derived from that content into kb-items.jsonl and report artifacts without any explicit consent, warning, or minimization control. In a knowledge-ingest context, this can propagate sensitive information from local documents into new files that may be retained, shared, or further processed unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file states that the skill outputs multiple files and instructs the user to run the tool with an output directory, but it does not warn that the skill will write files to disk. For markdown files, omissions about behavior affecting user data or system state can warrant a warning, even when the writes are local and expected.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency python-docx is unpinned, which makes builds non-reproducible and can cause the skill to install different versions over time, including vulnerable or breaking releases. In a document-ingestion skill that parses attacker-controlled office files, dependency drift increases supply-chain and parser-risk exposure.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

python-docx
pypdf

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

python-docx has known historical advisories, including XXE-related risk, and the manifest does not specify a version, so there is no assurance that deployment avoids affected releases. In a workflow that extracts content from potentially untrusted document attachments, unresolved parser version ambiguity is a legitimate security concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency pypdf is unpinned, so the installed version may vary across environments and time, making it impossible to guarantee whether known parser vulnerabilities are present. Because this skill ingests shared PDF attachments from Feishu, an exposed PDF parsing library processes untrusted input directly, increasing the likelihood of denial-of-service or parser-abuse impact.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

python-docx
pypdf

Unverifiable Dependency: pypdf has 16 known advisory(ies) (CVE-2026-84310 (pypdf: Possible long runtimes/large memory usage when retrieving outlines); CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

pypdf has multiple published advisories related to excessive runtime, memory usage, and infinite-loop style conditions, but the dependency is not pinned, so the deployed version may still be affected. This is more dangerous in this skill than in a generic utility because the stated purpose is to ingest shared PDFs, meaning untrusted files can directly trigger parser-heavy code paths and cause denial of service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language logic for detecting content type depends on Chinese keywords and always returns Chinese labels such as '制度', '流程', and '其他'. This imposes a specific language/locale behavior without user opt-in or documented justification, which is a language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest and documentation name the output artifact as 'memory.candidate.md', while the implementation creates 'MEMORY.candidate.md'. This contradicts the documented output contract and can break downstream workflows expecting the documented filename.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.