Security audit

Feishu Messaging.Bak2

Security checks for vulnerabilities and agentic risk

Overview

This Feishu messaging skill is mostly aligned with sending messages, but it includes hardcoded Feishu app credentials and exposes more directory data than necessary.

Install only after reviewing the embedded Feishu credentials. Do not use the bundled APP_SECRET; the publisher should remove and rotate it. If you proceed, provide your own least-privileged Feishu app credentials through environment variables, confirm recipients and content before sending, and avoid running the user-search helper unless you are comfortable exposing employee directory details in terminal output.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 81% confidence
Finding: The documented behavior materially exceeds and diverges from the declared purpose, which can mislead operators about what data the skill accesses and what actions it can perform. That kind of mismatch is dangerous because it weakens informed consent, review, and least-privilege deployment, especially where Feishu identities, chat membership data, uploads, and app credentials are involved.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill is framed as simple message sending, but the documentation includes broader resource operations such as image/file upload and general Feishu resource management. This increases the chance that reviewers or users authorize the skill under a narrower trust model than its actual data exfiltration and content-upload capabilities justify.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Image and file upload capabilities are more sensitive than plain text messaging because they can transmit arbitrary local content off-host to Feishu. When those capabilities are not justified or disclosed in the skill purpose, they create a meaningful risk of unintended data transfer and overbroad authorization.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script prints employee number, email, mobile number, and department IDs to stdout even though the stated operational purpose is sending Feishu messages. Exposing unnecessary employee directory attributes expands PII disclosure risk through terminals, logs, CI output, or shared execution environments.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation describes sending messages and uploading files/images to Feishu without warning that user-provided content or local files will be transmitted over the network to a third-party service. Lack of clear disclosure can lead to accidental sharing of sensitive data, especially in agent-driven contexts where users may not realize local artifacts are being uploaded.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A hardcoded fallback Feishu app secret is embedded directly in the script, which is a clear credential exposure issue. If the code is shared, committed, or reused in other environments, attackers can obtain the secret and mint tenant access tokens to access Feishu APIs under this app's privileges.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script contains hardcoded Feishu APP_ID and APP_SECRET directly in source code, exposing reusable credentials to anyone with repository or package access. In a messaging skill context, these secrets can be abused to obtain tenant access tokens and send messages as the application, potentially enabling impersonation, spam, or broader API abuse depending on granted scopes.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script includes a hard-coded default Feishu APP_SECRET and also prints credential-derived sensitive values to the console, which risks credential exposure through source control, logs, screenshots, or shared terminal history. In a messaging skill context, exposed app credentials can let an attacker obtain access tokens and send messages as the tenant app, potentially leading to impersonation, spam, or broader API abuse depending on granted permissions.

Static analysis

No suspicious patterns detected.