泛微 e-office 即时通讯（IM）WebSocket API - 私聊、群聊、AI助手等

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:17 AM UTC
• Version: 1.0.0

Overview

This skill is for enterprise messaging, but it documents broad authenticated messaging and group-management actions with weak scoping and insecure examples that could expose tokens or message content.

Install only for a trusted e-office IM environment, prefer wss/https endpoints, use a narrowly scoped and revocable token, and require explicit confirmation before sending messages, reading offline content, deleting or withdrawing messages, changing work status, or modifying group membership.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29

Finding

OA Tokens and Plaintext Messages Transmitted Over Insecure Transport

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29, SKILL.md:47-49, SKILL.md:80-83, references/im-api.md:109-111, references/im-api.md:504-507
Vulnerability Type: Insecure transport and ineffective message confidentiality
Risk Level: High

Vulnerable Code

SKILL.md:29:

text

WebSocket URL: ws://{EOFFICE_IM_BASE_URL}/

SKILL.md:47-49:

javascript

const socket = io('http://localhost:3000', {
  auth: {
    token: 'your-token-here'

SKILL.md:80-83:

javascript

message_content: 'AES-encrypted message content',
text_message_content: 'Plaintext message content',

references/im-api.md:109-111:

javascript

const socket = io('http://localhost:3000', {
  auth: {
    token: 'YOUR_OA_TOKEN'

references/im-api.md:504-507:

javascript

message_content: encrypt(content, key, iv),
text_message_content: content,
message_type: 1,
sender: 'current_user',

Technical Analysis

The Skill explicitly documents unencrypted ws:// and http:// connections while placing an OA access token in the Socket.IO authentication handshake. HTTP and plaintext WebSocket traffic do not provide transport confidentiality or integrity. If these examples are used on an untrusted network, a network-positioned attacker can observe or manipulate the handshake and subsequent events.

The documented message format also transmits the same content twice: once as AES ciphertext in message_content and again as plaintext in text_message_content. Consequently, encrypting message_content does not protect message confidentiality. Intermediaries, the IM service, server-side logs, monitoring systems, and any component able to inspect the event payload can access the plaintext field.

This issue is particularly significant because the token grants access to an API that supports private messaging, group messaging, group membership changes, message deletion or withdrawal ...[truncated 1969 chars]

Remediation

View remediation

Remediation Suggestions

1. Require https:// and wss:// for every non-local deployment.
2. Validate EOFFICE_IM_BASE_URL before connecting and reject plaintext schemes unless an explicit development-only override is enabled.
3. Configure normal TLS certificate and hostname verification. Do not document options that disable certificate validation.
4. Remove text_message_content from transmitted payloads when message confidentiality is expected. If server-side search or rendering requires plaintext, clearly state that the design is not end-to-end encrypted.
5. Define an explicit encryption model, including key generation, key distribution, key rotation, authenticated encryption, and whether the server is intended to decrypt messages.
6. Prefer an authenticated-encryption construction such as AES-GCM. If CBC must be retained, add a secure integrity mechanism and require fresh, unpredictable IVs.
7. Prevent OA tokens and plaintext messages from being written to application, proxy, monitoring, or debugging logs.
8. Use short-lived, narrowly scoped tokens and implement revocation and rotation procedures for suspected exposure.
9. Enforce server-side authorization independently for every message, group-management, presence, and offline-message event. Do not trust client-supplied sender IDs, user IDs, room IDs, or membership lists.
10. Update all examples in SKILL.md, README.md, and references/im-api.md so secure transport and non-plaintext message handling are the documented defaults.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README presents capabilities for sending messages, creating groups, deleting content, and querying online presence as routine actions, but it does not warn about recipient verification, privacy implications, authorization boundaries, or destructive effects. In an agent skill context, this can normalize high-impact actions and increase the chance that an LLM-driven agent performs sensitive messaging or group-management operations without explicit user confirmation or adequate safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is configured to activate for very broad IM-related requests, including '任何涉及即时通讯的操作', which can cause the agent to invoke network-capable messaging actions in contexts where the user did not clearly intend external message transmission or account/group modification. Because this skill supports sending messages, querying chat history, and managing group members, over-broad triggering increases the risk of privacy leaks, unintended side effects, and misuse of authenticated IM capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a WebSocket connection that transmits a token, login user ID, and message-related identifiers, but it does not warn users that message content and metadata will be sent over the network, and the example even shows a non-TLS ws/http style connection. In a messaging context, these data elements are sensitive; absent disclosure and transport-security guidance, users may unknowingly expose credentials, identities, message contents, and communication patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill exposes destructive or security-sensitive operations such as withdrawing messages, deleting messages, adding/removing group members, and deleting groups without any warning, authorization guidance, or confirmation requirements. In an authenticated enterprise IM environment, these actions can disrupt communications, remove evidence, alter group access, or cause accidental/unauthorized changes if the agent invokes them too readily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples explicitly include and log text_message_content plaintext alongside the encrypted payload, which normalizes sending and exposing sensitive chat content in clear text. In an IM API context, this is particularly risky because developers may copy the example directly, causing private messages to be visible in browser consoles, logs, telemetry, or intermediaries despite the presence of AES encryption for another field.

Content

No source excerpt is available for this finding.