Agent Evaluation Report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.0

Overview

This report-writing skill is mostly coherent, but it can write generated reports to a fixed Feishu knowledge base without clear per-use approval or destination control.

Install only if you intend to generate Chinese AI agent evaluation or test reports and are comfortable reviewing where the output goes. Before use, confirm whether Feishu knowledge base 7616288931050507220 is yours or your organization's approved destination, and avoid giving the skill sensitive security findings, credentials, personal data, or internal deployment details unless external publication has been approved.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Hardcoded External Document Destination Lacks Authorization Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-16
Vulnerability Type: Excessive tool permissions and an unverified external write destination
Risk Level: Medium

Evidence

yaml

allowed-tools: [read, write, feishu_create_doc, feishu_update_doc, feishu_fetch_doc, message]

The configuration also assigns the report destination to the Feishu knowledge-base identifier 7616288931050507220 and a fixed test-report node.

Technical Analysis

The Skill is intended to generate evaluation reports from user-supplied testing information. Such reports can contain security findings, defect descriptions, system architecture, deployment details, performance results, and release risks.

The Skill permits external Feishu document creation, update, and retrieval while prescribing a fixed knowledge-base destination. It does not require confirmation that the destination belongs to the user, verify that its audience is authorized to receive the report, offer a destination override, classify or redact sensitive content, or default to local storage before publishing externally.

The message capability is also granted even though the documented report-generation workflow does not establish a need to send messages. This expands the available permission surface beyond the minimum capabilities explicitly required by the task.

This is a least-privilege and authorization-boundary issue. Possession of the tool permissions does not itself prove that an external write will occur, but a runtime that follows the documented destination can publish sensitive material without sufficient destination-specific authorization checks.

Attack Path

1. A user supplies internal testing data, including defects, security results, deployment details, or risk assessments.
2. The Skill formats that information into an evaluation report.
3. The report workflow uses the configured Feishu creation or update capability.
4. The fixed k ...[truncated 1206 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded Feishu knowledge-base and node destination.
2. Require the user to select and explicitly confirm the destination before each external publication.
3. Display the destination identifier, document visibility, and intended recipients in the confirmation prompt.
4. Default to generating a local Markdown file and make external publication a separate opt-in action.
5. Verify that the current user and runtime identity are authorized to write to the selected destination.
6. Add a data-classification and redaction step for credentials, internal addresses, vulnerability details, personal data, and deployment information.
7. Remove the message permission unless a documented workflow requires it. If required, restrict recipients and require explicit approval before sending.
8. Separate read, create, and update operations so each invocation receives only the minimum tool capabilities required.
9. Record external publication events, destination identifiers, approving users, and document identifiers in an audit log without storing sensitive report content unnecessarily.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are generic report-writing terms and can match many ordinary user requests, increasing the chance this skill activates outside its intended scope. Because the skill is authorized to write to Feishu documents and local files, accidental activation can cause unintended content creation or persistence without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states internal write destinations but does not clearly warn the user that generated content may be written to a Feishu knowledge base and saved locally. This reduces informed consent and can lead to inadvertent disclosure, storage of sensitive test data, or unexpected persistence of generated reports in shared locations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation section lists when to trigger but not when to abstain, so the skill may be selected for ambiguous requests that resemble testing or reporting tasks. In this context, the lack of boundaries is more risky because the skill has write-capable tools and a predefined knowledge-base destination, which can turn a routing mistake into unauthorized document creation or modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The package description is written entirely in Chinese and states the skill generates standardized AI agent system test reports, implying a fixed language/locale expectation. The file does not indicate any user opt-in or configurable language choice, which can conflict with language/locale policy requirements.

Content

No source excerpt is available for this finding.