Back to skill

Security audit

Feishu Archive

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Feishu archiving guide with disclosed document creation, upload, and permission-setting behavior.

Install only if you want agents to archive content into Feishu. Before using it, confirm the destination folder, uploaded files, collaborator list, and read/edit permissions, especially for sensitive project or business data.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill description is broad enough to match generic documentation, note-taking, and sharing tasks, not just narrowly scoped Feishu archiving actions. In an agent environment, this can cause over-invocation and unnecessary access to document creation, upload, and permission-setting workflows, increasing the chance of unintended data propagation or permission changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The natural-language description combines Chinese and English instruction text ('Use when needing to...') without indicating whether the skill should respond in the user's preferred language. This can conflict with language/locale expectations if the organization requires respecting user language choice.

Content

No source excerpt is available for this finding.