飞书产品需求交付

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed product-requirements workflow that investigates user-provided pages, requires product confirmation, and publishes a Feishu document; its sensitive access is purpose-aligned but should be used carefully.

Install this only if you want Codex to inspect authenticated product pages, capture screenshots, and create or update Feishu requirement documents. Review the pages and destination document/folder before use, and confirm that screenshots are masked for account, phone, ID, secret, or other sensitive data before publication.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a high-level product management automation workflow centered on analyzing existing pages, producing requirements content, and publishing the result to Feishu. The supplied code does none of that. It only provides a local CLI script for annotating an image with dashed rectangles, arrows, and text labels based on a JSON specification, then saving the result. While screenshot annotation could be a supporting sub-step in a larger requirements workflow, this code chunk by itself does not implement the declared primary purpose and lacks all key behaviors named in the description, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a comprehensive requirement-authoring and publishing skill. The supplied code does not implement that workflow. Instead, it performs a narrow compliance check against a manifest: loading JSON, scanning two provided files for required and forbidden content, and failing if expected strings are missing. While some checked fields (roles, stories, exceptions, acceptance criteria, confirmed status, published content) are thematically related to the declared domain, the code only validates their textual presence after the fact. That is materially different from investigating pages, deriving requirements, confirming them with product, and publishing to Feishu. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description promises a workflow that gathers information from existing pages, produces a requirements baseline, gets product confirmation, and publishes to Feishu. The supplied code does none of that operational work. It only parses an input file and validates structural/content requirements such as headings, ID sequences, acceptance criterion format, URL/image evidence presence, and status wording. While these checks are related to requirements-document quality, they are only a supporting validation step, not the described end-to-end skill behavior. Therefore the description materially overstates and misrepresents the implemented capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill requires reading multiple local reference files and directing execution of validation/audit scripts, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap where the runtime may permit broader file access than users expect, weakening least-privilege controls and making misuse or accidental overreach harder to detect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The invocation description is broad enough to trigger on many generic requirement-writing requests, including requests involving signed-in pages, screenshots, and document publication. Over-broad routing increases the chance the skill is invoked in contexts requiring stronger safeguards, narrower user consent, or more explicit tool scoping, which can lead to unintended access to internal pages or documents.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

The skill explicitly instructs the agent to 'discover page facts independently' and to propose defaults while minimizing user questions. In the context of signed-in page investigation and requirements definition, this encourages autonomous business and operational decisions that can cause unauthorized browsing, mistaken assumptions, or publication of inaccurate requirements without sufficient human validation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

Read [references/intake-card.md](references/intake-card.md). Extract the requirement name, related pages, current problem, target users, desired result, known rules, exclusions, and references.

Do not ask the user to write a full PRD. Discover page facts independently. Propose low-risk business defaults. Ask only questions whose answers materially change roles, permissions, visible behavior, state changes, data meaning, exception handling, or acceptance results.

### 2. Investigate the real product

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The value for confirmed_status is fixed to a Chinese-language phrase, which can impose a specific language/locale in a manifest that otherwise provides no user choice or documented regional justification. This matches the policy concern for language/locale constraints expressed in natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is entirely prescriptive in Chinese and uses mandatory wording such as '必须使用以下一级标题', which effectively forces a specific language/locale for the skill output. Under the policy, language constraints should either provide user opt-in or be clearly documented as a justified region-specific requirement, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The entire skill file is presented only in Chinese and does not state that the skill is intended specifically for Chinese-speaking users or offer any language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The validator requires specific Chinese headings and later checks for exact Chinese status strings, which enforces a single language/locale in the skill behavior. This is a natural-language policy concern because users are not given an opt-in or alternative language path.

Content

No source excerpt is available for this finding.