Feishu Messaging.Bak

• Outcome: Review
• Latest audit: May 28, 2026 · 7:47 AM UTC
• Version: 1.0.0

Overview

This Feishu skill appears aimed at messaging, but it bundles live API scripts with hardcoded Feishu credentials and under-disclosed access to employee directory data and file uploads.

Review carefully before installing. Do not run the bundled scripts with the embedded Feishu credentials; the exposed secrets should be removed and rotated by the publisher. If this skill is used, provide your own least-privilege Feishu app credentials, confirm every recipient/message/upload manually, and avoid directory lookups that print phone, email, employee number, or department data unless that access is explicitly authorized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented behavior goes beyond the declared purpose of a simple messaging retry/member lookup skill by including broader Feishu resource management and logging of API responses that may contain personal or operational data. This mismatch can mislead users and reviewers about the data accessed and actions performed, increasing the chance of overbroad use and unintended exposure of user/chat information.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The manifest and overview frame the skill primarily as messaging, but the body also documents image/file upload and broader Feishu resource operations. That scope expansion matters because users may authorize or invoke the skill under a narrower trust assumption than its actual capabilities justify.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: Image and file upload functions are not clearly necessary for the stated use case of group/member lookup and message retry. Unjustified upload capability broadens the attack surface and increases the risk of unintended data transfer, especially in enterprise chat environments where uploaded media may contain sensitive information.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script goes beyond the stated messaging/document-creation purpose by performing directory lookup and then fetching detailed profile data for each matched user. In an agent skill context, this enables unnecessary collection and disclosure of employee information, increasing privacy and insider-enumeration risk without clear need for sending a message.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code explicitly prints personal directory fields including employee number, email, mobile number, and department IDs. Exposing these fields to terminal output is a privacy issue and can facilitate employee profiling, phishing, and internal reconnaissance, especially when the skill only needs to help send Feishu messages.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script implements a full application-level authentication flow to mint a tenant_access_token, which materially expands its capability beyond merely formatting or sending a message. In the context of a messaging skill, embedding auth logic means anyone with the script and bundled secrets can obtain reusable API access and potentially call additional Feishu APIs permitted to the app, not just send one test message.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file hardcodes a Feishu APP_ID and APP_SECRET directly in source code, which is a classic secret exposure issue. Anyone who can read the repository, package, logs, or copied script can reuse those credentials to obtain tenant access tokens and act as the Feishu application within the granted permission scope.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill can send messages, enumerate group members, and upload files/images, all of which can affect privacy and enterprise data handling, yet there is no explicit warning about what data may be accessed, transmitted, or logged. In this context, missing disclosure is risky because the APIs operate on potentially sensitive communications and identity data.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script contains hardcoded fallback Feishu application credentials, meaning anyone with access to the code can reuse them to authenticate against the Feishu API if the associated app is still valid. Embedded secrets are a serious credential-exposure issue because they are easy to leak through source control, logs, redistribution, or reuse in other environments.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script retrieves profile data from Feishu and prints it directly without any privacy notice, minimization, or confirmation step. In this skill context, that makes sensitive employee data easy to expose to anyone running the script or viewing its output, which is more dangerous because the advertised purpose is messaging, not directory export.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script transmits hardcoded credentials to Feishu over the network as part of the authentication request, meaning the primary problem is not transport security but the fact that embedded secrets are operationally used from source code. This increases exposure because a copied or leaked script remains immediately usable for live authentication without any additional setup or user awareness.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script embeds a default Feishu APP_ID and APP_SECRET directly in source and uses them to obtain an access token for outbound API calls. Hardcoded credentials are a real secret-exposure risk: anyone with source access can reuse them to impersonate the application, send messages, or access tenant-scoped APIs permitted to that app.

Static analysis

No suspicious patterns detected.