T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:82
- Finding
- Reports Are Automatically Published to a Hard-Coded External Knowledge Base<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 82-113 and 163-167 **Vulnerability Type**: Fixed external publication destination without explicit user authorization **Risk Level**: Medium ### Vulnerable Code Snippet The following is an English-normalized rendering of the relevant instructions and commands: ```markdown **Knowledge Base ID:** 7293072412831481884 #### Step 1: Check knowledge-base permissions feishu_wiki action=spaces Confirm that the knowledge-base list is visible. If access is unavailable, ask the user to add the bot to the knowledge base. #### Step 2: Create a top-level document feishu_wiki action=create space_id=7293072412831481884 \ obj_type=docx title="[business direction name]" #### Step 3: Create child documents feishu_wiki action=create space_id=7293072412831481884 \ parent_node_token=[top-level node token] \ obj_type=docx title="01-Opportunity Scoring Report" #### Step 4: Write document content feishu_doc action=write \ doc_token=[document token] \ content="[report content]" - Create each document and write its content immediately. ``` ### Technical Analysis The skill directs the agent to publish generated reports to Feishu knowledge-base space `7293072412831481884`. This destination is embedded in the skill rather than supplied or explicitly approved by the user. The permission check only determines whether the bot can see available spaces. It does not verify: - That the hard-coded space belongs to the requesting user. - That the user is authorized to publish information to that space. - Which users or groups can read documents created in that space. - Whether the generated reports contain confidential business information. - Whether the user approves the final destination and content immediately before publication. The workflow also requires documents to be written immediately after creation. This reduces the opportunity to preview and redact the generated content before it is disclos ...[truncated 1932 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded Feishu space ID from the skill. 2. Require the user to provide or select the destination knowledge base for every publication operation. 3. Display the destination name, space ID, intended audience, document hierarchy, and content summary before writing anything. 4. Obtain explicit user confirmation immediately before the first document-creation or write operation. 5. Verify that the requesting user owns or is authorized to use the selected destination. 6. Query and display the destination's access controls where the Feishu API supports doing so. 7. Default to returning reports in the current session or saving them locally when no approved destination is available. 8. Separate report generation from publication so users can review, redact, and approve the final content. 9. Avoid the instruction to write documents immediately after creation; instead, stage all content and perform publication only after final approval. 10. Apply least-privilege credentials that can access only user-approved spaces. 11. Record an audit event containing the approving user, destination, document identifiers, timestamp, and publication result. 12. Add a configurable denylist or tenant-bound allowlist to prevent publication to destinations outside the user's organization. ]]>