T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search-user.js:8- Finding
Hardcoded Feishu Application Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Messaging.Bak2
Security checks for vulnerabilities and agentic risk
Overview
This Feishu messaging skill is mostly aligned with messaging workflows, but it ships apparent app secrets and scripts that can send messages and expose employee contact data.
Review before installing or running. Do not use the bundled Feishu credentials; rotate them if they belong to you, replace them with securely supplied environment credentials, and limit the Feishu app scopes. Treat message text and uploaded files as data sent to Feishu, and avoid running the user-search script unless you are authorized to view and log employee contact details.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/test-send-message.js:111- Finding
Application Secret and Access Token Fragments Disclosed in Logs
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/search-user.js:74- Finding
Excessive Feishu Directory Data Retrieval and PII Logging
- Content
View full analysis
{ const options = { hostname: 'open.feishu.cn', port: 443, path: `/open-apis/contact/v3/users/${userId}?user_id_type=open_id`, method: 'GET', headers: { 'Authorization': `Bearer ${token}` } }; const req = https.request(options, (res) => { let body = ''; res.on('data', (chunk) => body += chunk); res.on('end', () => { const result = JSON.parse(body); if (result.code === 0) { resolve(result.data); } else { reject(new Error(`获取详情失败：${result.msg}`)); } }); }); ``` It then writes employee attributes to standard output: ```javascript console.log(`👤 姓名：${details.name}`); console.log(` ID: ${user.user_id}`); console.log(` 工号：${details.employee_no || 'N/A'}`); console.log(` 邮箱：${details.email || 'N/A'}`); console.log(` 手机：${details.mobile || 'N/A'}`); console.log(` 部门：${details.department_ids ? details.department_ids.join(', ') : 'N/A'}`); console.log(''); ``` ### Technical Analysis The documented workflow requires locating a recipient identifier so that a Feishu message can be sent. However, the script retrieves full user details and prints employee number, email address, mobile number, and department identifiers. These attributes are not necessary merely to select an `open_id`. This violates data-minimization and least-privilege principles. It also converts directory data protec ...[truncated 1766 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a narrow workflow, but the examples include authenticated API usage and direct messaging to a specific user ID, which are materially different operational behaviors from the described group/member lookup and document flow. In a security review context, this kind of under-disclosure is risky because it hides the real trust boundary: the skill handles credentials and can send data to external recipients.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a narrow workflow, but the examples include authenticated API usage and direct messaging to a specific user ID, which are materially different operational behaviors from the described group/member lookup and document flow. In a security review context, this kind of under-disclosure is risky because it hides the real trust boundary: the skill handles credentials and can send data to external recipients.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a narrow workflow, but the examples include authenticated API usage and direct messaging to a specific user ID, which are materially different operational behaviors from the described group/member lookup and document flow. In a security review context, this kind of under-disclosure is risky because it hides the real trust boundary: the skill handles credentials and can send data to external recipients.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script embeds fallback Feishu app credentials directly in source code, meaning anyone with code access can use them to obtain tenant access tokens. Hardcoded secrets are easily leaked via repositories, logs, copies, or package distribution and can enable unauthorized API access to organizational data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes a Feishu APP_ID and APP_SECRET and immediately uses them to obtain a tenant access token for outbound API calls. Embedding live application credentials in a test script is dangerous because anyone with file access can reuse them to authenticate as the application, send messages, and potentially access other granted Feishu APIs; in a messaging skill context, this capability is directly operational rather than incidental, which increases risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The application secret is stored in plaintext and used to authenticate requests without any protection boundary, prompting direct transmission to the Feishu token endpoint whenever the script runs. This creates a straightforward secret-exposure path: anyone who copies the repository or logs can recover the secret and mint valid access tokens, enabling impersonation of the app and abuse of its permissions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js try { // 获取 token console.log('📝 获取 access token...'); const token = await getTenantAccessToken(); console.log(`✅ Token 获取成功\n`);
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script hardcodes fallback Feishu APP_ID and APP_SECRET and will automatically use them when environment variables are absent. Embedding live-looking outbound authentication credentials in a distributed script can expose tenant access, enable unauthorized API use, and cause accidental cross-tenant messaging or abuse if the repository is shared.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill includes code that consumes sensitive application credentials (
APP_ID/APP_SECRET) and makes external API calls, but the manifest does not declare any tool scope or permissions boundary. That omission weakens reviewability and can cause the skill to be invoked without a clear contract about credential use or external network behavior.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest frames the skill as messaging/document workflow, but the body also documents image and file upload operations. This expands the data-exfiltration surface beyond plain text messaging, because arbitrary user-supplied files or media may be transmitted to Feishu without that broader scope being obvious from the manifest.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger text lists scenarios such as '发送消息失败需要重新尝试' without defining exact invocation phrases or boundaries for when the skill should activate. This broad troubleshooting-oriented wording could match many common conversations about retrying failed messages, increasing the risk of unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill encourages sending messages and uploading files/images to an external Feishu service without clearly warning that user content will leave the local environment. This creates a privacy and compliance risk because users or operators may provide sensitive text or attachments without informed consent or policy checks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script does more than support message sending: it searches the organization directory and then retrieves full user profiles for each match. In the stated skill context, this expands access to employee data beyond what is necessary and increases privacy and insider-enumeration risk if the tool is misused or run broadly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script sends the searched name to Feishu's user search API and then retrieves detailed user profile data including email, mobile number, and employee number. Although there are progress logs, they do not warn that personally identifiable information will be queried from and displayed via a remote service, which is a missing user warning for privacy-impacting network operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code prints employee number, email, mobile number, and department IDs to the console, which are sensitive personnel attributes not needed just to send a message. Exposing this data in terminal output can leak PII through shell history, logs, screenshots, CI output, or to operators who only needed a messaging identifier.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
User-facing strings are written in Chinese throughout the script, and date formatting is explicitly forced to 'zh-CN'. This is a natural-language policy concern because it imposes a specific language and locale without user opt-in or documented justification.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description explicitly claims '文档创建工作流', suggesting document creation is part of the skill's intended behavior. In the actual documented code, the available examples cover chat search, message sending, image upload, file upload, and chat member queries, but no document creation APIs or flows are present.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's comments and all console output are written in Chinese, and there is no option for users to select another language or locale. This constitutes a natural-language policy concern because the skill enforces a specific language without documented opt-in or a region-specific justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes this skill as a Feishu message sending and document creation workflow, with trigger scenarios around finding group members/group IDs and retrying failed sends. This file additionally implements a current-user information API call, which is a separate identity/profile lookup capability and is not justified by the stated purpose of sending messages in this script.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script explicitly formats timestamps with toLocaleString('zh-CN'), which imposes a specific locale regardless of the user's preferences or environment. This is a natural-language/locale policy issue because the file does not offer any choice or document why a Chinese locale is required.
- Content
Static analysis
No suspicious patterns detected.