飞书个人记账(含面板app)

• Outcome: Review
• Latest audit: Jun 2, 2026 · 10:23 AM UTC
• Version: 2.1.0

Overview

This Feishu bookkeeping skill matches its accounting purpose, but it needs Review because it handles long-lived credentials, remote financial records, and deletion authority with weak safeguards.

Review carefully before installing. Use a dedicated low-privilege Feishu app and a test Base first, avoid pasting or echoing secrets in chat where possible, rotate any secret already exposed in logs, manually confirm image-parsed entries before writing them, and do not run cleanup or delete commands without a backup. Treat the Android APK as a separate app that should be verified before installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: Directing the agent to distribute an APK download link and assist with Android app builds expands the skill beyond simple accounting and setup into software delivery. This increases supply-chain and user safety risk, especially since APK installation is sensitive and no integrity verification or trust warning is provided.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs autonomous extraction of amounts from uploaded bill images and immediate recording without confirmation. That can cause incorrect financial entries and unintended writes both locally and to Feishu, especially when OCR or visual inference is imperfect.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file documents a full APK dashboard application architecture, including WebView-based UI, localStorage credential handling, rendering flows, and Android build/release details, which is materially different from the declared skill scope of setup plus daily bookkeeping via scripts. This mismatch can conceal undeclared functionality and expands the trusted attack surface, making review and user consent incomplete.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The document describes undeclared analytics/dashboard capabilities such as summary rendering, charting, local credential storage, and APK build/release workflows that are not mentioned in the manifest description. Hidden or undocumented application functionality is dangerous because it can process sensitive financial data outside the user's expected workflows and evade normal review boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script requests broad and destructive Feishu Base scopes, including delete and update permissions for apps, tables, fields, and records, even though the stated accounting workflow mainly requires creating and writing accounting records. In a bookkeeping skill that stores financial data, overbroad scopes significantly increase blast radius if the app is misused or its token is exposed, enabling deletion or tampering of accounting data and table structure.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The inline comment presents the scope list as the full set of permissions required for the accounting system, but the actual list includes broader destructive access than the described use case implies. This kind of misleading justification can normalize excessive privilege requests and cause administrators or users to approve dangerous access without understanding the real risk.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The skill metadata says it performs daily bookkeeping and Feishu sync, but the script also supports deleting local and remote records. Hidden destructive capability increases user risk because an agent or user may invoke deletion without realizing the skill can remove accounting data from both storage locations.

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: The CLI help says Feishu sync is enabled by default, but the flag is defined as store_true, so users cannot explicitly disable it with a corresponding --no-feishu switch. In an agent context, misleading option semantics can cause unintended transmission of financial notes and amounts to Feishu when operators believe sync behavior is controllable or clearly documented.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script explicitly prints the App Secret, Base Token, and table identifier to stdout and also emits them in machine-readable JSON. In setup workflows, stdout is commonly captured by shells, CI logs, agent transcripts, or telemetry, so this behavior can leak long-lived credentials beyond the intended user and enable unauthorized access to the Feishu tenant or accounting data.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The setup trigger phrases are broad enough to activate on ordinary requests about bookkeeping or Feishu configuration. This raises the chance that the skill begins sensitive credential-collection and permission-setup flows without a clearly intentional invocation of this specific skill.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The usage triggers include common everyday phrases like '记账' or '花了X元', which can appear in normal conversation. Ambiguous activation is risky because it can cause unintended local and remote writes or data lookups without the user clearly asking to run the skill.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill tells the agent to solicit App ID and App Secret and later resend sensitive credentials back to the user, but provides no secrecy warning or safer handling guidance. Collecting and echoing secrets in plain conversation increases the chance of credential exposure through chat logs, screenshots, or platform retention.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions direct the agent to persist long-lived credentials into a local .env file without any discussion of local storage risk, file permissions, or secret lifecycle. Storing Feishu app credentials and tokens unencrypted on disk materially increases exposure if the host is shared, compromised, or backed up insecurely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Automatically recording transactions from images without confirmation lacks a warning about OCR/vision errors and the consequences of writing bad data locally and remotely. Users may not realize that a mistaken parse can immediately alter accounting records in two places.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script performs irreversible bulk deletion of all records in the selected table immediately after parsing arguments, with no interactive confirmation, dry-run mode, or secondary safety check. In this skill context, the danger is elevated because it targets accounting data, where accidental deletion can destroy financial records and disrupt auditability.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script deletes the local bill file automatically when the last record is removed, with no interactive confirmation, dry-run, or recovery safeguard. In an agent/tooling environment, this can lead to accidental irreversible data loss from a single command invocation or mistaken index selection.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Printing the provided App Secret and embedding it in JSON output creates a direct secret-exposure channel. Because setup scripts are often run inside agent frameworks that log outputs automatically, this materially increases the chance of credential compromise and subsequent misuse of Feishu APIs or access to the created bitable.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.