Agent Testcase Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:20 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a test-case generator, but it can publish content to a fixed Feishu knowledge-base location without clear user confirmation or destination control.

Install only if you intend generated test cases to be usable with the configured Feishu workspace. Before using it with confidential requirements, confirm where the agent will write, remove unused Feishu/message permissions if possible, and require explicit approval before any external publication.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:8

Finding

Hard-Coded External Feishu Destination and Excessive Communication Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8 and 13–18
Vulnerability Type: Excessive tool permissions and unsafe external data destination
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: [read, write, feishu_create_doc, feishu_update_doc, feishu_fetch_doc, message]

text

## Feishu document write location

Knowledge base: 7616288931050507220
Node: Evaluation/Test Cases
wiki_node: FZXtwQd70iFCD3kifibcdBbpnId

The labels in the second excerpt have been translated into English for reporting; the identifiers are reproduced exactly.

Technical Analysis

The Skill’s declared function is to generate standardized test cases from user-provided requirements or test points. That function can be completed by returning text in the current conversation or, if explicitly requested, writing to a user-selected file.

However, the Skill grants Feishu document creation, update, and retrieval tools as well as a general messaging tool. It also specifies a fixed Feishu knowledge-base node as the write destination. The instructions do not require runtime verification that this destination belongs to the user, nor do they require explicit confirmation before externally publishing generated content.

User inputs and generated test cases may contain confidential requirements, internal API structures, internal URLs, account information, personal data, or realistic test data. If such content is written to the hard-coded destination, users or collaborators with access to that destination may receive information that the current user did not intend to disclose.

The general message capability and feishu_fetch_doc permission are not necessary for basic test-case generation. Their inclusion increases the available communication and data-access surface beyond least privilege.

The bearer token shown elsewhere in the Skill is only the placeholder {token}. The audit found no hard-coded credential, credential-file collection, executab ...[truncated 1760 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove message, feishu_fetch_doc, feishu_create_doc, and feishu_update_doc from allowed-tools unless a user explicitly requests Feishu integration.
2. Default to returning generated test cases in the current conversation or writing them only to a user-selected local file.
3. Do not hard-code tenant-specific knowledge-base or node identifiers in the distributed Skill.
4. Require the user to provide or select the external destination at runtime.
5. Before every external write, display the exact destination, identify the data that will be transferred, and obtain explicit user confirmation.
6. Validate that the authenticated user is authorized to write to the selected destination.
7. Apply data-loss-prevention checks before publication, including redaction of credentials, access tokens, personal data, private URLs, and confidential test values.
8. Separate test-case generation from external publication into distinct operations so that generation does not implicitly authorize transmission.
9. Grant Feishu update or retrieval permissions only for the specific operation requested, and revoke or omit them afterward.
10. Record external-write events with destination, requesting user, timestamp, and content classification while avoiding sensitive content in logs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and usage instructions are written as mandatory Chinese-language guidance, including trigger phrases only in Chinese, with no indication that users may choose another language. This creates a natural-language locale constraint without user opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely prescriptive in Chinese and explicitly states the format is '强制使用', which imposes a language/locale requirement. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.