Article to Feishu

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This skill does the article-import workflow it advertises, but it fetches arbitrary URLs and downloads remote files with weak scoping and privacy controls.

Review before installing. Use this only for public, non-sensitive article URLs, avoid signed/private/internal links, and run it in an environment without access to internal networks or sensitive local files. Prefer a unique private temp directory, add URL allowlists and download limits, and confirm Feishu document creation before allowing the agent to write to your workspace.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/download_article_images.sh:29

Finding

Unrestricted Article URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

/dev/null) ``` The documented workflow also encourages passing a user-provided article URL directly into this script: ```bash bash {baseDir}/scripts/download_article_images.sh "$ARTICLE_URL" /tmp/article-img/ ``` ### Technical Analysis The script passes an arbitrary user-controlled URL directly to `curl`. It does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Whether the address is loopback, private, link-local, reserved, or a cloud metadata address. - Redirect destinations followed by `curl -L`. - The presence of URL credentials. - Whether the URL belongs to a supported public article domain. Substring checks in `detect_referer` only select a Referer value and do not restrict the actual request destination. Conseq ...[truncated 1861 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_article.sh:13

Finding

Complete User-Supplied URLs Are Disclosed to Jina AI Reader

Content

View full analysis

/dev/null ``` The same behavior appears in `scripts/extract_images.sh`: ```bash URL="$1" JINA_API="https://r.jina.ai/" # Fetch article content CONTENT=$(curl -sL "${JINA_API}${URL}" 2>/dev/null) ``` It also appears in `scripts/download_images.sh`: ```bash URL="$1" OUTPUT_DIR="$2" JINA_API="https://r.jina.ai/" REFERER="https://www.toutiao.com/" # Create output directory mkdir -p "$OUTPUT_DIR" echo "Fetching article content..." CONTENT=$(curl -sL "${JINA_API}${URL}" 2>/dev/null) ``` ### Technical Analysis Each script concatenates the complete user-supplied URL to `https://r.jina.ai/` and sends the resulting request to an external service. No warning, consent check, or sensitive-parameter filtering is performed. URLs can contain security-sensitive information, including: - Signed query parameters. - Temporary access tokens. - Document identifiers. - Password-reset or invitation tokens. - Internal hostnames and paths. - User identifiers and tracking parameters. HTTPS protects the request while it is in transit, but it does not prevent the receiving external service from observing the complete URL. The issue is therefore an unannounced cross-boundary disclosure rather than plaintext transport. ### Attack Path 1. A user supplies a private, signed, token-bearing, or otherwise sensitive article URL. 2. The Agent invokes `fetch_article.sh`, `extract_images.sh`, or `download_images.sh`. 3. The script embeds the complete URL in a request sent to `r.jina.ai`. 4. Jina AI Reader receives and ca ...[truncated 806 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_article_images.sh:29

Finding

Predictable Shared Temporary Directory Permits Symlink-Based File Overwrite

Content

View full analysis

/dev/null) ``` The Skill documentation recommends a fixed shared path: ```bash bash {baseDir}/scripts/download_article_images.sh "$ARTICLE_URL" /tmp/article-img/ ``` ### Technical Analysis The documented workflow uses the predictable shared directory `/tmp/article-img/`, while downloaded files receive predictable names such as `01.jpg` and `02.png`. The script does not: - Create a uniquely named private directory. - Verify ownership or permissions of an existing directory. - Reject symbolic links. - Create output files with exclusive creation semantics. - Check whether a destination file already exists. - Remove stale files before later upload. - Apply restrictive permissions. On a multi-user system, another local process may pre-create the directory or predictable destination entries. If an entry is a symbolic link, `curl -o` may follow it and overwrite the linked target when the Agent has permission to write that target. Existing ordinary files can also remain in the directory and may be mistaken for newly downloaded article images during the subsequent Feishu upload workflow. ### Attack Path 1. A l ...[truncated 1363 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_images.sh:25

Finding

Unbounded Remote Downloads Enable Resource Exhaustion and Unvalidated File Ingestion

Content

View full analysis

/dev/null) # Extract image URLs IMAGE_URLS=$(echo "$CONTENT" | grep -oE 'https?://[^)"'\'' ]+\.(jpg|jpeg|png|gif|webp)' | sort -u) if [ -z "$IMAGE_URLS" ]; then echo "No images found in the article." exit 0 fi # Count images TOTAL=$(echo "$IMAGE_URLS" | wc -l) echo "Found $TOTAL images. Downloading..." # Download images with Referer header i=1 for IMG_URL in $IMAGE_URLS; do # Extract extension EXT="${IMG_URL##*.}" # Handle query parameters in extension EXT=$(echo "$EXT" | cut -d'?' -f1) # Format filename with zero-padding printf -v FILENAME "%02d.%s" $i "$EXT" FILEPATH="${OUTPUT_DIR}/${FILENAME}" echo "[$i/$TOTAL] Downloading: $FILENAME" # Download with Referer header (anti-hotlink bypass) curl -sL -H "Referer: $REFERER" "$IMG_URL" -o "$FILEPATH" # Check if download succeeded if [ -f "$FILEPATH" ]; then SIZE=$(stat -c%s "$FILEPATH" 2>/dev/null || stat -f%z "$FILEPATH" 2>/dev/null || echo "unknown") echo " Size: $SIZE bytes" else echo " Failed to download!" fi ((i++)) done ``` The generic downloader similarly performs unconstrained downloads: ```bash HTML=$(curl -sL "$URL" 2>/dev/null) IMAGE_URLS=$(echo "$HTML" | grep -oE '(https?://[^"'\''()<>]+\.(jpg|jpeg|png|gif|webp))' | sort -u | head -50) ``` ```bash HTTP_CODE=$(curl -sL -w "%{http_code}" -H "Referer: $REFERER" "$IMG_URL" -o "$FILEPATH" 2>/dev/null) ``` ### Technical Analysis The network requests do not define: - A connection timeout. - A total execution timeout. - A ...[truncated 2263 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

描述强调这是一个可把多种网站文章导入飞书、自动下载图片并按顺序插入的技能；而给出的代码仅是 convert_to_feishu.sh 模板，注释和输出都明确说明“Actual conversion must be done by AI agent using feishu tools”。它能做的主要是调用 download_images.sh、fetch_article.sh，统计图片、预览内容，并提示后续人工/AI agent 如何调用 feishu_create_doc、feishu_update_doc、feishu_doc_media。因此，代码的实际行为与声明的完整能力存在实质差距：核心的飞书文档生成与插图并未在代码中实现，且站点支持范围也未体现为多站点实现，而是明显偏向 Toutiao。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明的核心能力是“把网页文章转换为飞书文档”，包括处理文章内容并将图片插入飞书。实际代码只是一个 shell 脚本：接收文章 URL 和输出目录，自动推断 referer，抓取页面 HTML，用正则提取图片 URL，然后将图片下载到本地目录。虽然这与“自动下载图片”这一子功能部分相关，但它缺少声明中最关键的主功能：解析文章正文、生成飞书文档、调用飞书接口、插入内容与图片。因此代码实际行为仅覆盖声明功能中的一个辅助步骤，主目的与对外描述存在明显不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明的核心用途是“把网页文章转换为飞书文档”，并支持多个站点、自动插图。实际代码只是一个 shell 脚本，用于从文章内容中提取图片 URL 并下载到本地文件夹，且注释和参数都表明其主要针对 Toutiao。代码中没有任何飞书 API 调用、文档生成、正文解析重组、图片插入到文档、或多平台适配逻辑。因此其主要目的与声明严重不符，属于明显描述与行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared skill describes an end-to-end article-to-Feishu conversion tool supporting multiple websites and automatic image handling. The supplied code only retrieves page content through r.jina.ai and extracts image links with grep, outputting deduplicated URLs. This is only a small helper-like behavior and does not implement the core declared purpose: no Feishu API usage, no document generation, no article text extraction/formatting, no image downloading, and no ordered insertion. The code’s actual scope is materially narrower and different from the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明的核心功能是把网页文章转换并导入飞书文档，且支持多网站与图片处理。但提供的代码块只是一个简单抓取脚本：它读取输入 URL，构造 r.jina.ai 代理地址，并通过 curl 获取页面内容。代码没有任何飞书 API 调用、文档生成、认证、图片下载、图片重排/插入、站点适配解析等实现。因此其实际行为仅覆盖“抓取文章文本内容”的一小部分前置步骤，与声明的主要用途存在实质性不一致。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

└────────┬────────┘ ▼ ┌─────────────────┐ │ 6. 清理临时文件 │ rm -rf /tmp/article-img/ └─────────────────┘

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

└────────┬────────┘ ▼ ┌─────────────────┐ │ 6. 清理临时文件 │ rm -rf /tmp/article-img/ └─────────────────┘

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

echo "  # Step 5: Continue with more sections..."
    echo ""
    echo "  # Step 6: Cleanup"
    echo "  rm -rf /tmp/article-img/"
    exit 0
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

echo "  # Step 5: Continue with more sections..."
    echo ""
    echo "  # Step 6: Cleanup"
    echo "  rm -rf /tmp/article-img/"
    exit 0
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/convert_to_feishu.sh (reported line 54)May include surrounding context.

sh

echo "  # Step 5: Continue with more sections..."
    echo ""
    echo "  # Step 6: Cleanup"
    echo "  rm -rf /tmp/article-img/"
    exit 0
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/convert_to_feishu.sh (reported line 54)May include surrounding context.

sh

echo "  # Step 5: Continue with more sections..."
    echo ""
    echo "  # Step 6: Cleanup"
    echo "  rm -rf /tmp/article-img/"
    exit 0
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/convert_to_feishu.sh (reported line 54)May include surrounding context.

sh

echo "  # Step 5: Continue with more sections..."
    echo ""
    echo "  # Step 6: Cleanup"
    echo "  rm -rf /tmp/article-img/"
    exit 0
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill explicitly instructs use of shell commands such as bash, curl, grep, and rm, but declares no tool scope or allowed-tools restrictions. That leaves the runtime free to expose broader shell capability than necessary, increasing the chance of command execution beyond the intended workflow if the URL or paths are mishandled elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs use of Jina AI Reader and Feishu without warning users that article URLs, article contents, and possibly embedded resources may be sent to third-party services. This can cause unintended disclosure of private or access-controlled content, especially if a user supplies sensitive URLs assuming the process is local.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes converting articles from many supported sites into Feishu documents, but this script is explicitly limited to downloading images from a Toutiao article. It neither handles other listed sites nor performs any Feishu document creation, so the implemented behavior does not match the claimed skill functionality for this component.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script explicitly advertises and implements anti-hotlink bypass by setting a forged Referer header when downloading remote images. In the context of an article-import skill, this exceeds normal content conversion behavior and enables access patterns intended to evade origin protections, which can violate site controls and facilitate unauthorized retrieval of remote assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script fetches untrusted remote content derived from a user-supplied URL, extracts image links, and writes downloaded files to a local directory with no validation of content type, size, source trustworthiness, or storage limits. In a skill that processes arbitrary public webpages, this increases the risk of privacy leakage, unwanted network access, disk consumption, and storage of unexpected or harmful content under the guise of image downloads.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the user-supplied article URL to a third-party proxy service (r.jina.ai) to retrieve content, which exposes the target URL and potentially associated access patterns to an external party without explicit disclosure or consent. In the context of a skill that converts arbitrary web articles, this creates a real privacy and data-handling risk, especially if users provide sensitive, private, or internal links expecting direct retrieval by the tool itself.

Content

No source excerpt is available for this finding.