T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:59
- Finding
- Hardcoded Feishu Application Credentials## Vulnerability Details **File Location**: `SKILL.md:59-60` **Vulnerability Type**: Hardcoded reusable authentication credentials **Risk Level**: High ### Vulnerable Code ```bash APP_ID="cli_a924632610b8dbd9" APP_SECRET="c3TXscIJPF1f8jcQ4mJJegNVk72ktbwK" ``` ### Technical Analysis The Skill contains a plausible Feishu application identifier and application secret directly in a distributable example. Anyone with access to the Skill can recover these credentials without needing access to a separate secret store. The document subsequently uses the credentials to request a tenant access token from Feishu's official authentication endpoint. Although sending credentials to that endpoint is necessary for the declared image-sending functionality, embedding reusable credentials in the Skill is not necessary and violates least-privilege and secret-management practices. The exposed secret may allow an attacker to authenticate as the associated Feishu application if the credentials remain active. The actual privileges available to an attacker depend on the permissions granted to that application in Feishu. ### Attack Path 1. An attacker obtains or reads the distributed `SKILL.md` file. 2. The attacker extracts the embedded `APP_ID` and `APP_SECRET`. 3. The attacker submits the credentials to: `https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal`. 4. If the credentials are valid, Feishu returns a tenant access token. 5. The attacker uses that token to call Feishu APIs authorized for the application. 6. Possible follow-on actions include uploading images, sending messages, consuming API quotas, or invoking any other API permitted by the application's assigned scopes. ### Impact Assessment Successful exploitation may provide unauthorized access to the Feishu application's tenant-level API privileges. The precise scope is bounded by the permissions assigned to the application, but it could include unaut ...[truncated 349 chars]
- Remediation
- ## Remediation Suggestions 1. Revoke and rotate the exposed Feishu application secret immediately. 2. Replace both credential values in documentation with clearly nonfunctional placeholders. 3. Load credentials at runtime from environment variables or a dedicated secret manager. 4. Do not print, log, cache, or return application secrets or tenant access tokens. 5. Restrict access to the runtime secret to the process and operators that require it. 6. Configure the Feishu application with only the scopes required to upload images and send messages. 7. Review Feishu authentication and API audit logs for unauthorized token issuance or API calls made using the exposed credentials. 8. Add automated secret scanning to the repository and release process to prevent future credential inclusion.