Security audit

Feishu Wechat Publish

Security checks for vulnerabilities and agentic risk

Overview

The skill’s publishing purpose is coherent, but it needs review because it silently binds user identity and handles sensitive document, token, and WeChat credentials with weak disclosure and persistence controls.

Use this only if you are comfortable sending Feishu document content, embedded media, user identity metadata, subscription tokens, and WeChat AppID/AppSecret to the third-party relay. Before installing, the publisher should add explicit consent, document relay retention and revocation, avoid silent open_id binding, use secure secret storage, pin or preinstall dependencies, and fix the temporary-file handling script.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:54
Finding: Silent Identity Binding and Use of a Stable User Identifier as Authentication
Content: View full analysis
Content-Type: application/json Body: { "open_id": "ou_xxxxxxxxx" } 3. After binding succeeds, all subsequent requests can use the `X-Feishu-Open-Id` header instead of `Authorization: Bearer`. ### Subsequent authentication - Method A: `X-Feishu-Open-Id: ` - Method B: `Authorization: Bearer ` ``` The snippet above is translated into English from the audited file while preserving its operative meaning. ### Technical Analysis The Skill explicitly instructs the Agent to extract a stable Feishu user identifier from conversation metadata without informing the user. It then transmits that identifier to an external relay and persistently associates it with the user's subscription token. This behavior exceeds the minimum privileges required to publish one document. A ...[truncated 2014 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:94
Finding: Subscription Bearer Token Stored in a Predictable Plaintext File
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:137
Finding: Automatic Execution of Unpinned Third-Party Packages with Global Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch-feishu-images.sh:17
Finding: Path Traversal, Destructive Deletion, and Sensitive Data Retention in Temporary Storage
Content: View full analysis
}" # Extract doc token from URL or raw token DOC_TOKEN=$(echo "$INPUT" | grep -oP '(?:wiki|docx)/\K[A-Za-z0-9]+' || echo "$INPUT") WORK_DIR="/tmp/feishu-images-${DOC_TOKEN}" rm -rf "$WORK_DIR" mkdir -p "$WORK_DIR" ``` The same predictable directory is subsequently used for document image downloads: ```bash DOWNLOAD_RESULT=$(cd "$WORK_DIR" && lark-cli docs +media-download --token "$token" --output "./$token" --overwrite 2>/dev/null || echo '{"ok":false}') ``` No cleanup trap removes the directory or downloaded images before the script exits. ### Technical Analysis If the supplied argument does not match the expected Feishu URL pattern, the complete raw argument becomes `DOC_TOKEN`. It is then concatenated directly into a filesystem path. Shell quoting prevents word splitting, but it does not neutralize filesystem path traversal. Inputs containing `/`, `..`, or absolute-path-like components can alter the normalized target of `rm -rf`. For example, a raw token containing traversal components can make `WORK_DIR` resolve outside the intended temporary-directory namespace. The directory name is predictable and is created under shared `/tmp` without `mktemp`, explicit ownership checks, or a restrictive umask. This permits local race and pre-creation attacks. The script also leaves downloaded Feishu images on disk after completion, exposing potentially confidential document content to other processes or later users of the same environment. The `DOC_TOKEN` value is additionally passed to `lark-cli`, so strict validation is required even where shell quoting is present. ### Attack Path #### Path-Traversal Deletion 1. An attacker causes the script to be invoked with a crafted raw ...[truncated 1537 chars]
Remediation: View remediation
&2 exit 2 fi ``` 2. Parse supported URLs with a dedicated URL parser and reject unsupported schemes, hosts, paths, and token formats. 3. Create a random private directory: ```bash umask 077 WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/feishu-images.XXXXXXXX")" ``` 4. Register cleanup immediately: ```bash trap 'rm -rf -- "$WORK_DIR"' EXIT HUP INT TERM ``` 5. Never construct a recursive deletion target directly from untrusted input. 6. Verify that all returned download paths resolve beneath `WORK_DIR` before reading them. 7. Reject symlinks and unexpected file types when processing downloaded media. 8. Set explicit file-size and image-count limits to prevent local resource exhaustion. 9. Avoid placing sensitive image data in long-lived shell variables where practical. 10. Ensure temporary files and directories are deleted on successful completion and all error paths. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest describes a relatively narrow publish workflow, but the skill actually performs broader actions including downloading document media, encoding content, handling user identifiers, storing tokens locally, and collecting account-binding credentials. This mismatch reduces informed consent and makes it easier for users and reviewers to underestimate the amount of sensitive data being accessed and transmitted to the external relay.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description states that final article content is sent to feishu.shing19.cc, but it does not prominently warn users that document bodies, embedded images, whiteboard exports, and identifiers such as open_id may be transmitted to an external third-party service. In this context, the omitted disclosure is dangerous because the skill operates on potentially sensitive enterprise documents and media, making uninformed exfiltration more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to install CLI tools and run authentication/configuration shell commands, including login flows and background processes, even though the stated purpose is document reading and publishing. In a client environment this expands the skill's capabilities into system modification and credentialed tool setup, increasing the risk of unauthorized command execution, environment tampering, and unexpected access to user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill asks users for subscription tokens and WeChat AppSecret, and instructs the agent to send them to the external relay, but does not provide a strong user-facing warning about the risks of sharing those credentials or the fact that they are handled by a third party. Because AppSecret and tokens can enable account operations, this omission meaningfully increases the chance of credential misuse, overcollection, or uninformed disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly describes sending Feishu document contents and downloaded images to an external relay service, but it does not warn about third-party data transfer, retention, or privacy implications. Because Feishu documents may contain sensitive internal content and images, this omission can cause users or downstream agents to exfiltrate data off-platform without informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to persist subscription tokens in .feishu-wechat-publish.json in the working directory. Local plaintext credential storage creates a risk of token exposure through filesystem access, backups, logs, accidental commits, or reuse by other tools operating in the same directory.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs the agent to run npx skills add larksuite/cli -y -g without pinning a specific version or integrity, which allows execution of whatever package version is current at install time. In an agent context, this creates a software supply-chain risk because a compromised or malicious upstream package update could execute arbitrary code during installation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill goes beyond publishing article content by collecting WeChat AppID and AppSecret and transmitting them to a third-party relay for account binding. These are sensitive credentials, and centralizing them in an external service materially increases the blast radius if the service, transport, or logs are compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON file contains user-facing title/content text entirely in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the language/locale policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code performs filesystem deletion with rm -rf and writes downloaded image files under /tmp, which are safety-relevant file operations. While the script prints progress messages, it does not clearly disclose up front that it will remove and recreate a local working directory for the supplied document token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script calls lark-cli to fetch document markdown and later download media, transmitting and receiving document data over the network. Although this is part of the script's function and progress logs exist, there is no clear warning in the header or usage text that document contents and embedded images will be retrieved to the local machine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.