Security audit

ri

Security checks for vulnerabilities and agentic risk

Overview

This Feishu document skill appears purpose-built for document editing, but it gives agents broad write, delete, and local-file upload abilities without enough safety scoping.

Install only if you expect agents to edit Feishu documents. Before use, require agents to confirm any replace-all, delete, or delete-and-rewrite operation, and only allow local file uploads from paths you explicitly provide for that task.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manifest says to activate when the user mentions "Feishu docs, cloud docs, or docx links." While "Feishu docs" is fairly specific, "cloud docs" and especially "docx links" are broad and ambiguous trigger conditions that could overlap with normal conversation or unrelated document references. The file does not provide exclusion conditions or negative examples to narrow when the skill should or should not activate.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents destructive operations like full-document replacement and appending without prominently requiring confirmation before modifying an existing document. In an agent context, omission of safety guidance raises the risk of accidental overwrite of user data, especially because `write` replaces the entire document.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The `delete_block` action enables irreversible content removal, but the documentation does not require confirmation, backup, or user warning before deletion. In a document-editing skill, this omission makes accidental or prompt-induced destructive edits more likely.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly permits `upload_image` and `upload_file` to read from arbitrary local `file_path` values such as `/tmp/report.pdf`, which expands the skill from Feishu document operations into local filesystem access. In an agent setting, this can enable exfiltration of sensitive local files into Feishu documents if a prompt or workflow causes the agent to reference unintended paths.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guidance recommends deleting affected blocks and rewriting content to achieve insertion, but it does not warn that this is a destructive workflow that can remove user data, metadata, formatting, or structure if applied incorrectly. In a document read/write skill, such instructions can directly lead an agent to perform irreversible modifications without explicit user confirmation or backup steps.

Static analysis

No suspicious patterns detected.