T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:51- Finding
Plaintext Feishu Credentials Stored in Agent-Readable Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
飞书增强套件
Security checks for vulnerabilities and agentic risk
Overview
This Feishu automation skill is not malicious, but it handles powerful Feishu credentials and actions with unsafe secret guidance and weak scoping.
Review before installing. Use a dedicated least-privilege Feishu app, do not store real App Secret values in TOOLS.md, prefer environment variables or a secret manager, avoid running the token command in logged environments, and verify the app only has the Feishu scopes needed for record creation and message sending.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu-api.sh:24- Finding
Feishu Tenant Access Token Exposed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill advertises broad Feishu capabilities including documents and calendar automation, but the described implemented behavior is much narrower and different. This mismatch is dangerous because users and orchestrators may grant permissions, supply credentials, or approve actions based on overstated functionality, reducing informed consent and making hidden or incomplete behavior harder to audit. In security reviews, description-behavior gaps are a classic signal of over-privileged or misleading integrations.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares shell-capable dependencies and installation steps but does not define any explicit tool scope such as allowed-tools or permissions. That creates an unnecessary trust gap: an agent may infer broader execution authority than intended, and shell access combined with stored Feishu credentials could enable unintended command execution, data access, or exfiltration. In an automation skill that handles app secrets and office data, missing scope boundaries materially increases risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill is '适用于需要高效办公自动化的中文用户', which frames the skill as intended specifically for Chinese-language users. Under the policy, forcing or constraining language/locale without user opt-in or explicit justified regional scope is a natural-language policy issue.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh return 1 fi local response=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$app_id\",\"app_secret\":\"$app_secret\"}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This shell script sends sensitive data over HTTP requests, including FEISHU_APP_ID/FEISHU_APP_SECRET for token retrieval and user-supplied record/message payloads to Feishu APIs. Although there are code comments and an error message for missing configuration, there is no user-facing disclosure at the points of execution warning that credentials and provided content will be transmitted to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh local records_json="$3" local token=$(get_tenant_token) curl -s -X POST \ "https://open.feishu.cn/open-apis/bitable/v1/apps/$app_token/tables/$table_id/records/batch_create" \ -H "Authorization: Bearer $token" \ -H "Content-Type: application/json" \
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The package description is written entirely in Chinese and the keywords include "chinese," which can indicate a language-specific constraint. Because the file does not state that Chinese is optional or that the skill is region-specific, this may violate the language/locale policy requiring user choice or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language comments, error text, and usage output are written only in Chinese, which effectively forces a specific language for user interaction. The file does not provide an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
- Content
Static analysis
No suspicious patterns detected.