飞书文档API对接

• Outcome: Review
• Latest audit: May 28, 2026 · 10:30 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Feishu/Lark API connector that handles sensitive tokens and can edit cloud documents, but I found no hidden exfiltration or unrelated behavior.

Install only if you intend to let the agent use your Feishu/Lark app permissions to read and change cloud documents, sheets, Base data, wiki/drive content, or IM messages. Use the minimum Feishu scopes needed, keep .env and the token file private, avoid storing tokens inside shared project folders, and require explicit confirmation before replace, delete-like, Base schema/record, or message-sending actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs use of shell, network, file I/O, and environment-based credentials, but it does not declare permissions. In an agent setting, undeclared capabilities reduce transparency and can let a reviewer or runtime underestimate what the skill can access, increasing the chance of over-privileged execution.

Missing User Warnings

Medium

• Confidence: 75% confidence
• Finding: The code automatically seeds and resolves user authentication tokens from local file-backed storage without any visible validation of file location, permissions, or explicit user consent in this path. In a multi-user or loosely controlled environment, this can expose persisted access and refresh tokens to other local users or to unintended file paths, enabling unauthorized access to Feishu resources.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The service performs batch deletion of document block children as part of section replacement without any built-in confirmation, dry-run mode, or guardrails. In an agent skill that can modify user-owned Feishu docs, a mistaken heading match, bad prompt, or automation error could irreversibly remove document content and cause integrity loss.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code persists Feishu user access and refresh tokens to a local .env-style file on disk. Although this appears intended for session continuity rather than exfiltration, storing long-lived bearer credentials in plaintext creates a real exposure if the file is read by another local user, backup system, malware, or accidentally committed/shared; the risk is somewhat reduced by chmod(0o600), but not eliminated.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: These commands perform remote document mutations such as append, block update, and section replacement immediately once invoked, with no user-facing confirmation, dry-run mode, or explicit disclosure at execution time. In an agent skill context, this increases the chance of unintended destructive edits to user-owned Feishu content if the tool is called from ambiguous or manipulated instructions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The sheet replacement command makes remote edits without any confirmation or visible disclosure that data in a spreadsheet will be modified. In an automation/agent setting, a mistaken token, sheet ID, or natural-language misunderstanding could silently alter business data at scale.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Base creation, table creation, record creation, and record updates all cause remote state changes but expose no guardrails or user-visible warnings. Because this skill is specifically intended to operate on Feishu APIs and organizational data, accidental writes can affect shared datasets, schemas, and records used by other users or workflows.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

"FEISHU_USER_REFRESH_TOKEN_EXPIRES_AT": str(refresh_expires_at),
    })
    os.environ["FEISHU_USER_ACCESS_TOKEN"] = access_token
    os.environ["FEISHU_USER_REFRESH_TOKEN"] = next_refresh_token
    if data.get("open_id") or env.get("FEISHU_USER_OPEN_ID", settings.user_open_id):
        os.environ["FEISHU_USER_OPEN_ID"] = data.get("open_id") or env.get("FEISHU_USER_OPEN_ID", settings.user_open_id)
    os.environ["FEISHU_USER_ACCESS_TOKEN_EXPIRES_AT"] = str(expires_at)

• Confidence: 84% confidence
• Finding: The code writes the refresh token into os.environ, making a highly sensitive long-lived credential globally accessible to any code running in the same process. In an agent/skill context where multiple components may coexist, this broadens secret exposure and can enable lateral credential access if another plugin, logger, debugger, or error reporter inspects environment state.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Safety Rules

- Never print `.env`, app secrets, user access tokens, refresh tokens, or webhook secrets.
- Before write operations, identify whether the call uses a user token or tenant/app token.
- Treat `expires_in` and `refresh_token_expires_in` returned by Feishu as the source of truth. Do not hard-code token lifetimes.
- `refresh_token` is single-use. After any refresh, immediately persist both the new `FEISHU_USER_ACCESS_TOKEN` and the new `FEISHU_USER_REFRESH_TOKEN`.
- New cloud resources must be user-owned by default. For doc creation, prefer `FEISHU_USER_ACCESS_TOKEN`; only use app-owned creation when the user explicitly accepts that limitation.

• Confidence: 80% confidence
• Finding: The skill instructs persistence of refreshed access and refresh tokens to storage, including a shared token file path and default filesystem location. Persisting long-lived or renewable credentials on disk creates session persistence risk: compromise of the workspace or user account can yield reusable tokens for ongoing API access.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.secret_argv_exposure

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/feishu_api/services/docs.py:87

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/feishu_openapi_tool.py:261

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: references/operations.md:86

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:112