Agent Requirement Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent requirement-analysis helper, but it can write PRD-derived reports to a fixed external Feishu location without clear user confirmation or destination control.

Install only if you trust the configured Feishu destination and intend analyzed requirement content to be written there. Before using it with confidential PRDs, confirm the target knowledge base and require an explicit preview/approval step or remove Feishu write/update permissions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Error

• Location: SKILL.md:7

Finding

Hardcoded External Feishu Destination Enables Unconsented Data Transfer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–18
Vulnerability Type: Unconsented external data transfer
Risk Level: High

Vulnerable Code

yaml

allowed-tools: [read, write, feishu_create_doc, feishu_update_doc, feishu_fetch_doc, message]

text

Knowledge base: 7616288931050507220
Node: Effect Evaluation/Requirement Analysis Reports
wiki_node: Eq5MwsZEpiKlP7kXzPFc8Uptnye

Technical Analysis

The Skill analyzes user-provided PRDs and requirement documents, which may contain confidential product plans, internal architecture, business rules, credentials, customer information, or other sensitive material. It is granted tools capable of creating and updating Feishu documents and specifies a fixed Feishu knowledge-base destination.

The Skill does not require the user to approve the transfer, verify ownership of the destination, preview the content, or redact sensitive information. The secondary specification in agent-requirement-analyzer.md describes generation of a structured analysis report but does not disclose or require external publication. Consequently, network-based document creation is not necessary for the declared core analysis function and exceeds minimum privilege.

The hardcoded destination may belong to a different user, tenant, or organization. Even when the Feishu integration itself is legitimate, sending derived content to an unverified fixed destination creates an unauthorized disclosure risk.

Attack Path

1. A user invokes the Skill and supplies a confidential PRD or requirement document.
2. The Agent reads and analyzes the document as required by the declared workflow.
3. The Skill's tool permissions permit use of feishu_create_doc or feishu_update_doc.
4. The Agent uses the hardcoded knowledge-base and wiki-node identifiers as the output destination.
5. The generated report, including information derived from the confidential source document, is ...[truncated 924 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded Feishu knowledge-base and wiki-node identifiers.
2. Default to returning the generated report directly to the requesting user without external transmission.
3. Remove feishu_create_doc, feishu_update_doc, feishu_fetch_doc, and message from allowed-tools unless the user explicitly requests external delivery.
4. If Feishu export is supported, require the user to provide or explicitly select the destination for each operation.
5. Before transmission, display the destination, the exact data to be uploaded, and a clear confirmation prompt.
6. Validate that the destination belongs to the authenticated user's tenant and that the user is authorized to write to it.
7. Apply sensitive-data detection and redaction before upload, with an option to cancel the operation.
8. Separate analysis from publication so generating a report never implicitly triggers a network write.
9. Document external-transfer behavior prominently in the Skill description and workflow.
10. Record auditable consent and destination metadata for authorized uploads while avoiding sensitive report content in logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is allowed to write and update Feishu documents via external-side-effect tools, but the skill text does not clearly warn the user that running it may create or modify documents in a shared knowledge base. This can lead to unintended data publication, overwriting shared content, or exfiltration of sensitive requirement analysis into an external workspace without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The activation guidance is expressed through Chinese trigger phrases such as '分析需求' and '需求解析', which constrains usage to a specific language. The file does not indicate that language selection is optional, nor does it document a justified region- or locale-specific limitation.

Content

No source excerpt is available for this finding.