Security audit

Release Package

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Feishu storage-manager purpose, but it includes real-looking Feishu credentials in test code and needs review before installation.

Review before installing. Do not run the bundled test as-is; remove the hardcoded Feishu credentials and rotate them if they were real. Use your own Feishu app with minimal Bitable and file-upload permissions, review install.sh before executing it, and only upload item names, locations, or images that you intend to store in Feishu.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares only a Bash tool interface but omits explicit permission declarations despite requiring shell execution, network access to Feishu, and likely environment-variable access for credentials. This weakens transparency and sandboxing assumptions, making it easier for the skill to access sensitive data or external services without clear user/operator consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is narrow, but the implementation reportedly also uploads images, contains hardcoded Feishu credentials and identifiers in test code, and performs local installation/linking actions. This mismatch is dangerous because users and reviewers may approve the skill for simple storage management while hidden or undocumented behaviors expose secrets, alter the local system, or exfiltrate data to external services.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The test file hardcodes real-looking Feishu application credentials and injects them into environment variables at runtime. Even though this is framed as test code, embedding secrets in source control exposes them to anyone with repository access and can enable unauthorized API access, data retrieval, or modification against the referenced Bitable resources.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill clearly describes collecting item names, storage locations, and optional images, but it does not provide a user-facing warning that this data is sent to Feishu/Bitable, an external service. Because storage locations can reveal sensitive personal information and images may contain additional private details, the omission undermines informed consent and can lead users to disclose data they would not otherwise share.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The configuration section requires Feishu application credentials and table access details, but it does not warn users that the skill depends on an external third-party account and will handle data through that service. This is primarily a transparency and privacy issue: users or deployers may grant broad API permissions without understanding the data exposure, retention, and account-level access implications.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description 'A simple storage manager' is too broad to clearly constrain when the skill should be invoked or what actions it is authorized to perform. In agent ecosystems, vague activation scope can cause the skill to be selected for unrelated tasks, increasing the chance of unintended data access, storage operations, or location updates beyond user intent.

Static analysis

No suspicious patterns detected.