飞书进化仪表盘

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

The skill has real Feishu reporting and evolver lifecycle functions, but it also adds under-disclosed autonomous execution, persistence, repository publishing, and cross-skill modification behavior.

Install only after reviewing and accepting that this skill can keep itself running, spawn agent work, mutate workspace memory and skill files, send logs and telemetry to Feishu, install packages in sibling skills, and automatically push repository changes. It should be constrained or changed to require explicit approval for cron/daemon persistence, git publication, package installation, raw log export, and any delegated-agent prompt injection.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:1212

Finding

Agent-Generated Output Is Evaluated as JavaScript

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: index.js:1066

Finding

Wrapper Injects Mandatory Instructions into Delegated Agent Tasks

Content

View full analysis

code -> docs. If a designated model is unavailable, use the closest alternative without changing the task phase.`; if (isLoop) { process.env.EVOLVE_EXTRA_MODES = `- Mode B (Wrapper Loop): - You are running under a wrapper-managed continuous loop. - Action: Perform ONE evolution cycle, then exit cleanly. - Do NOT call sessions_spawn. Do NOT try to self-schedule. - The wrapper handles cycling, reporting delivery, and git sync. ${modelRoutingDirective}`; } else { process.env.EVOLVE_EXTRA_MODES = `- Mode A (Atomic/Cron): - Do NOT call sessions_spawn. - Goal: Complete ONE generation, update state, and exit gracefully. ${modelRoutingDirective}`; } ``` The wrapper later appends another authoritative instruction block: ```javascript taskContent += `\n\n` + `━━━━━━━━━━━━━━━━━━━━━━\n` + `MANDATORY POST-SOLIDIFY STEP (Wrapper Authority -- Cannot Be Skipped)\n` + `━━━━━━━━━━━━━━━━━━━━━━\n\n` + `After solidify, a status summary file MUST exist for this cycle.\n` + `Preferred path: evolver core auto-writes it during solidify.\n` + `The wrapper will handle reporting AFTER git push.\n` + `If core write is unavailable for any reason, create fallback status JSON manu ...[truncated 2073 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: lifecycle.js:74

Finding

Recurring Cron Job and Detached Watchdog Create Durable Persistence

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: lifecycle.js:219

Finding

Environment and API Values Are Interpolated into Shell Commands

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: report.js:412

Finding

Generating a Report Can Install Dependencies and Modify Sibling Skills

Content

View full analysis

0) { healthAlert = `\n\n🚨 **SKILL HEALTH WARNING**: ` + `${issues.length} skill(s) broken.\n`; issues.slice(0, 3).forEach(issue => { healthAlert += `> **${issue.name}**: ${issue.issues.join(', ')}\n`; }); if (issues.length > 3) { healthAlert += `> ...and ${issues.length - 3} more.`; } } } catch (e) { console.warn('[Wrapper] Skill monitor failed:', e.message); } ``` The monitor enables healing by default and runs package installation: ```javascript function autoHeal(skillName, issues) { const skillPath = path.join(SKILLS_DIR, skillName); const healed = []; for (const issue of issues) { if (issue === 'Missing node_modules (needs npm install)') { try { execSync( 'npm install --production --no-audit --no-fund', { cwd: skillPath, stdio: 'ignore', timeout: 30000, windowsHide: true } ); healed.push(issue); console.log( `[SkillsMonitor] Auto-healed ${skillName}: npm install` ); } catch (e) { // npm install failed, leave the issue } } else if (issue === 'Missing SKILL.md') { try { const name = skillName.replace(/-/g, ' '); fs.writeFileSync( path.join(sk ...[truncated 1992 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:558

Finding

Autonomous Evolution Cycles Commit and Push Broad Workspace Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: report.js:256

Finding

Reports and Exports Can Disclose Logs, Telemetry, and Sensitive Workspace Data to Feishu

Content

View full analysis

c.name && c.name.includes('🧬') ); if (group) { return group.chat_id; } } pageToken = data.data.page_token; } while (pageToken); } catch (e) { console.warn(`[Wrapper] Group lookup error: ${e.message}`); } return null; } ``` Reports add system telemetry and recent error-log content: ```javascript const lastLine = (sysMon.getLastLine(errorLogPath) || '').substring(0, 200); errorAlert = `\n\n⚠️ **CRITICAL ALERT**: System reported a failure ` + `${(diffMs/1000/60).toFixed(1)}m ago.\n> ${lastLine}`; ``` ```javascript let footerStats = `${labels.proc}: ${procCount} | ` + `${labels.mem}: ${memUsage}MB | ` + `${labels.up}: ${uptime}s | ` + `${labels.load}: ${loadAvg} | ` + `${labels.disk}: ${diskUsage} | ` + `🔁 ${labels.loop}: ${loopStatus}`; await sendCard({ target: target, title: title, text: finalContent, note: footerStats, color: headerColor }); ``` The Feishu helper checks only four ...[truncated 3569 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Offline weekly analytics/report generation from local event/log files is less risky than process control, but it still materially differs from the declared interactive lifecycle/reporting wrapper role. This becomes dangerous if operators grant network or daemon-management trust based on the description while the skill instead aggregates potentially sensitive local history for reporting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This utility exposes a generic shell execution primitive by accepting an arbitrary command string and passing it directly to child_process.exec. In a Feishu-integrated wrapper or evolver-management skill, that capability materially increases risk because any upstream user-controlled input, prompt injection, or compromised caller can be turned into OS command execution, and the cache does not mitigate that danger.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · export_history.js (reported line 12)May include surrounding context.

js

const WORKSPACE_ROOT = path.resolve(__dirname, '../..');
try {
    require('dotenv').config({ path: path.join(WORKSPACE_ROOT, '.env') });
} catch (e) {}

const DOC_TOKEN = process.env.FEISHU_EVOLVER_DOC_TOKEN || '';

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · visualize_dashboard.js (reported line 14)May include surrounding context.

js

const WORKSPACE_ROOT = path.resolve(__dirname, '../..');
try {
    require('dotenv').config({ path: path.join(WORKSPACE_ROOT, '.env') });
} catch (e) {}

const DOC_TOKEN = process.env.FEISHU_EVOLVER_DOC_TOKEN || '';

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · export_history.js (reported line 24)May include surrounding context.

js

let token;
    try { token = JSON.parse(fs.readFileSync(TOKEN_FILE)).token; } catch(e) {}
    if (!token) return console.error("Error: No Feishu access token in " + TOKEN_FILE);

    let logContent = '';
    try { logContent = fs.readFileSync(LOG_FILE, 'utf8'); } catch(e) { return console.error("No log file: " + LOG_FILE); }

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The wrapper performs git add, git commit, git pull --rebase, and git push against a remote branch, which is materially broader than a lifecycle/reporting wrapper. This gives the skill autonomous power to mutate repository state and publish changes externally, creating supply-chain and integrity risk if the delegated agent is steered, compromised, or simply wrong.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The wrapper falls back to new Function('return (' + sanitized + ')')() on extracted agent output, effectively evaluating untrusted text as JavaScript. Because all child output must be treated as adversarial, this creates a direct code-execution path inside the wrapper process.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The wrapper appends high-priority natural-language instructions framed as mandatory authority, including file-writing requirements and behavioral rules for the delegated agent. This is dangerous because it can override the delegated agent's original constraints, manipulate outputs, and silently steer execution toward wrapper-chosen behavior.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The one-time thought injection reads arbitrary text from a file and places it into EVOLVE_HINT, directly influencing subsequent agent behavior. Any actor able to write that file gains a stealthy prompt-injection channel into the autonomous workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'ensure' path contains a hidden 'think phase' that goes beyond lifecycle management and performs autonomous task processing, cross-skill file reads, queue mutation, inbox writes, temporary script generation, and detached background execution. In a wrapper whose stated purpose is Feishu-integrated evolver lifecycle control, this materially expands authority and creates an unexpected code-execution and content-manipulation path that could be triggered without explicit user awareness.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: exec_cache.js:19

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:485

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: issue_tracker.js:64

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lifecycle.js:98

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: report.js:131

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: self-repair.js:20

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: skills_monitor.js:65

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: index.js:1232

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: lifecycle.js:776

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: export_history.js:15

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: export_history.js:23