Security audit

邮箱订单自动录入飞书

Security checks for vulnerabilities and agentic risk

Overview

The skill’s order-processing purpose is coherent, but it directs broad automatic email attachment processing, cloud uploads, Feishu writes, and notifications with too little confirmation and ships without the referenced implementation files.

Review carefully before installing. Only use this with explicit per-run consent for mailbox access and customer document uploads, pin and verify the ADP CLI dependency, and require the publisher to include the referenced scripts/config/demo files before trusting the automation on real orders.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:63
Finding: Security-Critical Workflow References Missing, Unverifiable Local Components
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill defines broad natural-language triggers such as '运行一下', '测试订单', and '处理这份订单' to launch a full end-to-end workflow that can read local files, process email attachments, upload source documents, write to Feishu Base, and send notifications. Because these phrases overlap with ordinary conversation and the workflow performs external side effects on potentially sensitive business documents, the skill risks executing high-impact actions without sufficiently explicit, scoped user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The mailbox path is configured to auto-process email attachments whenever the user expresses general intent like '跑邮箱通道' or '给我自动审核', and explicitly instructs the agent not to stop for confirmation unless the user says '只查询不处理'. This is dangerous because mailbox contents are sensitive external data, and automatic downloading, parsing, uploading, and notifying on broad trigger language can cause unintended data access, disclosure, and irreversible workflow actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire natural-language description and prescribed user-facing phrasing are presented only in Chinese, with no indication that the user may choose another language. This can violate a language/locale policy when a skill implicitly constrains interaction language without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.