Security audit

Feishu Task Workbench

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a Feishu task workbench, but it asks for broad cross-session authority and stores or may reveal session routing identifiers without enough scoping safeguards.

Install only if you are comfortable granting the skill cross-session messaging/history access and storing per-task session keys in local registry files. Prefer a host configuration that restricts session visibility to sessions spawned for the current user/workbench, redacts sessionKey and registry paths in normal responses, and invokes the registry helper without shell interpolation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:45
Finding: Overly Broad Cross-Session Visibility
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:169
Finding: Potential Shell Command Injection Through User-Controlled Registry Arguments
Content: View full analysis
close --summary "..." python3 scripts/task_registry.py --registry archive --summary "..." ``` Related creation and update workflows similarly place task titles, summaries, session keys, and registry paths into command-line arguments. ### Technical Analysis The Skill documents shell command templates into which runtime values are expected to be substituted. Task titles and summaries can contain user-controlled text, while account and peer identifiers influence the registry path. Quoting a value with double quotes is not sufficient if an agent builds a command by direct string interpolation. An input containing a closing quote, command substitution, shell metacharacters, or a newline can alter the resulting shell command. For example, a malicious summary could terminate the quoted argument and append an additional command. The Python registry script itself does not invoke a shell; `argparse` receives already parsed arguments. The vulnerability arises when the documented command templates are executed through a shell after unsafe interpolation. Consequently, exploitability depends on how the hosting agent invokes these examples. An argument-array API with shell interpretation disabled would prevent this attack. ### Attack Path 1. An attacker provides a task title or summary containing quote termination and shell syntax. 2. The agent directly inserts that content into one of the documented command strings. 3. The agent executes the resulting string through a shell-capable tool. 4. The shell parses part of the attacker-controlled value as command syntax rather than as one argument. 5. The injected command runs with the operating-system privileges of the host agent. The same pattern can ...[truncated 726 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to provide isolated task routing through session tools, but the described behavior is largely local registry management and does not actually demonstrate the promised session isolation. This mismatch can cause users or operators to trust security and isolation properties that are not really implemented, leading to task cross-contamination, incorrect routing, or unsafe operational assumptions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill describes filesystem-backed registry operations but does not declare an explicit tool scope or allowed-tools boundary. That increases the risk of overbroad tool access and makes it harder for the host to enforce least privilege, especially because the skill persists per-user task state to disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to create, update, close, and archive persistent task records on disk, but it does not clearly warn users that these actions modify durable state. In conversational environments, hidden persistence can surprise users, create privacy issues, and make accidental or unauthorized state changes more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill says sessionKey and registry path may be returned for troubleshooting, but these identifiers are sensitive operational metadata. Exposing them without warning or access control can leak internal topology, user/account identifiers embedded in paths, or enable misuse of session references by anyone who sees the conversation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document specifies Chinese-only invocation phrases such as 新建任务：<title>, 任务状态, and 任务列表, and even mandates a Chinese task header format [任务:#2 周报]. This is a natural-language locale constraint, but the file does not offer any user language choice or explain why Chinese is required for this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The canonical commands are prescribed in Chinese and the protocol directs alignment to that command set for Feishu, but the document does not offer an alternative language or indicate user opt-in. This can violate language/locale policy when users are forced into a specific language interaction model.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Treating ordinary plain-text follow-up as an implicit routing trigger creates ambiguous control boundaries in a multi-task environment. Users can easily send messages that are unintentionally attached to the current task, causing context bleed, misexecution, or accidental disclosure of task-specific content into the wrong workstream.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The fallback rule routes all unmatched input to currentTaskId, which is an overly broad default for a system designed to isolate multiple workstreams. This can cause unintended task actions, accidental data mixing between sessions, and makes prompt-injection or social-engineering attacks easier because arbitrary text automatically gains task context.
Content: No source excerpt is available for this finding.