Security audit

FeiShu Robot @ Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Feishu bot-to-bot messaging protocol, but it uses delegated user identity and text-based sender markers in ways that can misroute or impersonate replies.

Install only if you control the Feishu workspace and can enforce strict allowlists, explicit user authorization for delegated sends, immutable sender-ID validation, loop prevention, and auditing. Do not rely on display names or bracket markers as proof of sender identity.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:123
Finding: Spoofable Sender Identity and Reply Routing
Content: View full analysis
recipient】` or `【sender->recipient1,recipient2...】📌` - It was sent by a user (`sender_type = user`) - Its `msg_type` is `post` - It has a reference (`reply_to` field) If present: Parse the first message referenced by it and obtain the sender inside `【】`. If absent: Search upward and find the nearest message satisfying: - It matches the `【sender->recipient】` or `【sender->recipient1,recipient2...】` format - The sender is the sender of the current message ``` The reply rule at lines 284–289 additionally instructs the receiver to parse the sender from the marker and reply to that identity: ```text Reply rules: - If the message contains `[pin]【sender->recipient】[pin]` or `📌【sender->recipient】📌`, parse `【】` and reply to the sender named inside it. - If there is no marker, follow the normal logic and reply to the person who mentioned the bot. - Replies also use two steps: bot identity plus a user-identity reply. - Prefer a referenced user message when parsing the sender. - If no matching referenced message is found, search backward. ``` ### Technical Analysis The protocol treats a display name embedded in ordinary message content—`【sender->recipient】`—as an authoritative sender identity. Message bodies and display names are not authentication factors and can be controlled or imitated by group participants. Although the preferred path examines a referenced message, the protoco ...[truncated 2007 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:104
Finding: Automated Messages Sent Through a User Identity Without Explicit Authorization Controls
Content: View full analysis
recipient】 or 【sender->recipient1,recipient2...】📌"}]]}}', receive_id: 'group_id', receive_id_type: 'chat_id' }); ``` The surrounding instructions explicitly designate this as the second step sent through a user identity and state that it triggers a mention event for the targeted bot. ### Technical Analysis The Skill directs an automated agent to send messages using `feishu_im_user_message`, which represents a user identity rather than the bot's own service identity. The documented flow does not specify: - Per-send user consent. - Authorization checks for the destination group or recipient. - Restrictions on which user account may be represented. - Least-privilege OAuth scopes. - Visible disclosure that the message was generated automatically. - Safeguards preventing untrusted message content from initiating user-identity sends. If the agent possesses delegated user credentials, automated use of those credentials can cross the expected bot/user identity boundary. Messages can appear to originate from the delegated user and can trigger downstream mention handlers that specifically require a user-originated event. The risk is conditional on the deployment granting the agent valid delegated user credentials and message-sending scopes. The ...[truncated 1413 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill repeatedly specifies Feishu post payloads under the zh_cn locale key and presents the protocol as mandatory, with no indication that other locales may be used or that the user can choose a language. This can violate language/locale policy because it forces a specific locale rather than documenting a justified region-specific constraint or offering opt-in.
Content: No source excerpt is available for this finding.