Security audit

Feishu Reading Task

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Feishu reading-task helper, but users should be aware it can create Feishu tasks and record task details when broad trigger phrases are used.

Install only if you want an agent to turn conversation content into Feishu reading tasks. Before use, confirm what content will be sent to Feishu, who will be assigned, and where any memory/YYYY-MM-DD.md records are kept or deleted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code is related to the declared domain of Feishu reading tasks, but the implemented behavior is substantially narrower than the description. The description promises an end-user skill that reacts to trigger phrases, derives the relevant person and content from conversation context, creates the task in Feishu, and logs to memory. The actual script is just a helper that formats task data from already-supplied parameters and prints JSON. This is a material description-to-behavior mismatch because several core advertised capabilities are absent from the provided code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad and include common task-management language such as '待阅读', '稍后阅读', and '添加到待办', which increases the chance of accidental invocation during normal conversation. Because the skill automatically creates external Feishu tasks, unintended triggers can cause unauthorized or surprise task creation tied to conversation context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation describes automatic extraction of conversation content, creation of Feishu tasks, and writing to local memory files, but does not clearly warn users that external side effects and local persistence will occur. This weakens informed consent and can lead to unintended disclosure of links, titles, descriptions, or participant-derived identifiers into external systems and local storage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad, generic, and based on simple keyword matching, which can cause the skill to activate during ordinary conversation rather than from clear user intent. In this context, unintended activation could create Feishu tasks and persist conversation-derived content without meaningful confirmation, leading to privacy leakage, workflow abuse, or accidental task assignment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill states that it records conversation-derived content to a memory file but does not provide a clear user-facing warning at the point of use. In a messaging/task context, this increases the risk of silently storing links, titles, descriptions, and person-associated metadata that users may not expect to be retained, creating privacy and data-governance concerns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains natural-language usage text and argument descriptions entirely in Chinese, which imposes a specific language on users. Under the policy rule, forcing a language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing instructions, trigger descriptions, and examples are presented in Chinese, while the policy category requires flagging language constraints that force a specific language without opt-in. Nothing in the file offers an alternative language or explains that the skill is intentionally limited to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.