T09 · Insecure Skill Coding Practices
Error
- Location
scripts/feishu-board.js:12- Finding
Configurable API base URL permits credential and bearer-token exfiltration
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Whiteboard V2
Security checks for vulnerabilities and agentic risk
Overview
The skill’s main whiteboard workflow is plausible, but the package also contains undisclosed Feishu document/spreadsheet writers and unsafe credential-handling paths that should be reviewed before installation.
Install only after reviewing or removing the extra Bitable and Markdown-to-Docx scripts, use a dedicated least-privilege Feishu app, keep FEISHU_BASE_URL pinned to the official Feishu API endpoint, and avoid running get-tenant-token because it prints a usable bearer token.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu-board.js:166- Finding
Tenant access token is exposed through standard output
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/feishu-markdown-to-docx.js:7- Finding
Undeclared and unpinned third-party dependency executes at module load time
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to generate Mermaid or PlantUML for whiteboard creation, but the detected behavior reportedly edits Feishu Docx documents, transforms Markdown into blocks, and inserts tables and rich text. Such hidden document-editing functionality expands the blast radius beyond the user-expected whiteboard scope and can result in unintended content creation, data corruption, or abuse of document permissions under misleading labeling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to generate Mermaid or PlantUML for whiteboard creation, but the detected behavior reportedly edits Feishu Docx documents, transforms Markdown into blocks, and inserts tables and rich text. Such hidden document-editing functionality expands the blast radius beyond the user-expected whiteboard scope and can result in unintended content creation, data corruption, or abuse of document permissions under misleading labeling.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. **调用脚本**：执行 `scripts/feishu-board.js` 完成“创建画板块 + 填充节点”。
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script implements spreadsheet/Bitable creation while the skill manifest describes whiteboard generation from Mermaid or PlantUML. This capability mismatch is dangerous because it can cause users or orchestrators to invoke a tool under false assumptions, resulting in unintended document creation or data being written into a different Feishu surface than expected.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implemented flow reads a local markdown file, parses it as tabular data, and uploads records into a Feishu spreadsheet rather than generating diagram code for a whiteboard. In an agent setting, this is dangerous because it expands the effective data-handling and write capabilities beyond the declared purpose, increasing the chance of accidental exfiltration of local content and unauthorized modification of user resources.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script's behavior materially differs from the skill manifest: it writes Markdown-derived content into Feishu Docs rather than generating Whiteboard diagrams. This capability mismatch is dangerous because users, reviewers, or orchestration systems may grant the skill permissions and trust assumptions intended for whiteboard generation while it actually performs document modification through direct API calls, enabling unintended data writes and scope creep.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to use environment secrets and make outbound API calls, but it declares no explicit tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and can allow a deceptively simple skill to access secrets and network capabilities without clear policy review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description includes broad natural-language triggers like requests to draw various diagram types in Feishu docs, which can overlap with ordinary user requests. In an agent system, overly broad invocation criteria can cause the skill to activate unexpectedly and gain access to env-backed network actions in contexts where the user did not clearly intend this specific skill to run.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and surrounding instructional content are written entirely in Chinese and explicitly position the file as a reference for an agent, but there is no indication that language selection is optional or limited to a China-specific deployment. This creates a natural-language locale policy issue because it effectively constrains agent behavior to a specific language without user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file header explicitly states 'Feishu Bitable API - Create spreadsheets with any size,' which contradicts the whiteboard-focused manifest. While a misleading comment alone is not exploitable code, in security review it is a strong indicator of capability drift or repurposed code, making it easier for hidden or unexpected behavior to evade user and operator scrutiny.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The script imports fs and later reads arbitrary local markdown files, which is not justified by the stated whiteboard-generation purpose in the manifest. In an agent environment, unnecessary local file access is risky because it broadens the attack surface for unintended ingestion of sensitive local data that can then be transmitted to external APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code reads FEISHU_APP_ID and FEISHU_APP_SECRET from environment variables and later uses them to authenticate API requests. While missing credentials cause an error, there is no user-facing notice, comment, or documentation in this file warning that the skill consumes sensitive credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends parsed spreadsheet data to Feishu without any explicit disclosure or confirmation at the point of transmission. In a skill context, especially one whose manifest does not mention file ingestion or spreadsheet upload, this increases the risk of users unintentionally sending local data to a third-party service.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script exposes a dedicated
get-tenant-tokencommand that retrieves and returns a Feishu tenant access token directly to stdout, even though the skill’s primary purpose is creating and filling whiteboard content. In an agent-skill context, a standalone credential retrieval path expands abuse surface because callers can use the skill as a token minting primitive for unrelated Feishu API actions.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The
get-tenant-tokenpath prints the raw tenant access token to stdout withprint({ ok: true, tenantAccessToken: token }). In agent and automation environments, stdout is commonly captured in logs, tool transcripts, or returned to upstream users, which can immediately disclose reusable credentials and enable unauthorized Feishu API access.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script ingests arbitrary local files via --markdown-file, which extends its data-access surface beyond the advertised natural-language whiteboard generation use case. In an agent environment, this can lead to unintended local file access and exfiltration of sensitive content into Feishu Docs if an attacker or confused workflow can influence the file path.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file includes explanatory comments labeled only as Chinese-language documentation, with no indication of alternative language support or user choice. This can be a language-policy issue when a skill imposes a specific language without opt-in, especially if intended for a broader audience.
- Content