Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Feishu task-board poller, but it can run persistently and write completion records to a shared document based on external task text without approval or real task verification.
Review before installing. Use this only with a trusted, access-restricted Feishu task board and a least-privilege Feishu app. Treat the current implementation as a polling and acknowledgement tool, not a real autonomous task executor. Test with --once first, protect config.json from source control and broad file permissions, and avoid cron/continuous mode unless you add approval, audit logging, and clear rules for who may create tasks.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
console.log('='.repeat(60));
try {
// Step 1: get access token
console.log('\n1️⃣ Getting Feishu token...');
const token = await getTenantAccessToken();
The phrase 'auto-executes tasks assigned to the current AI agent' describes autonomous decision-making driven by content from an external collaborative document. Because task definitions can be modified by other parties, this creates a direct path for prompt injection, unauthorized action triggering, or execution of harmful workflows without human review.
# Smart Poller
> Periodically polls a Feishu (Lark) task board and auto-executes tasks assigned to the current AI agent.
**Version**: v1.0 | **Author**: socneo | **Category**: automation
The README openly advertises that the skill will poll a shared Feishu document, automatically execute tasks assigned to the agent, and write results back, but it does not provide an explicit safety warning about the trust boundary or the risks of executing document-sourced instructions. In this context, the task board is effectively a remote command source, so lack of clear warning and consent guidance increases the chance users deploy an autonomous executor against untrusted or broadly writable content.
The cron example encourages persistent periodic execution, which turns any unsafe task-ingestion behavior into a continuously exploitable channel. In combination with automatic task execution from Feishu, persistence increases exposure time and allows repeated triggering of malicious or mistaken tasks without active operator presence.
# Edit crontab
crontab -e
# Run every 15 minutes
*/15 * * * * cd /path/to/smart_poller && python3 poller.py config.json --once
The README explicitly promotes periodic polling of a Feishu task board and automatic write-back of task results, but it does not clearly warn users that the skill continuously reads from and modifies an external document on an ongoing basis. In an automation skill, this matters because users may deploy it without understanding the persistence, data access, and autonomous action scope, increasing the risk of unintended data exposure or unauthorized document changes.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
crontab -e
# 每 15 分钟执行一次
*/15 * * * * cd /path/to/smart_poller && python3 poller.py config.json --once
The phrase 'auto-executes tasks assigned to the current AI agent' describes autonomous decision-making tied to externally sourced task content. In this context, the danger is elevated because scheduled polling plus automatic execution can create a continuous remote-command channel, enabling prompt injection, unsafe tool use, or unintended actions without human review.
# Smart Poller Skill
**Smart Polling Skill** — Periodically polls a Feishu task board and auto-executes tasks assigned to the current AI agent.
📖 [中文文档](README.zh-CN.md)
The skill explicitly states that it will poll a Feishu task board, auto-execute assigned tasks, and write completion feedback, but it does not present this behavior as a prominent security warning or explain the trust boundary. That omission is dangerous because users may install it without understanding that external task-board content can directly drive local code or agent actions on a recurring basis.
The header states this is a polling script that 'executes tasks assigned to the current agent.' However, executeTask only inspects the task description for keywords like 'test', 'search', or 'monitor' and returns fixed strings without performing any real task-specific operation. This is an active mismatch between the documented intent and actual behavior.
The script writes completion-style feedback to the shared Feishu document even though no real task completion is verified. In an agent/task-board workflow, this can create false audit records, mislead other actors into believing work was performed, and enable task-state spoofing or operational bypass.
The module docstring says it 'auto-executes tasks assigned to the current AI agent,' and the main poller docstring repeats that it 'executes tasks.' In practice, execute_task only matches a few keywords and returns fixed messages, while poll merely appends those messages back to the Feishu document rather than performing the requested task actions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# -*- coding: utf-8 -*-
"""
Smart Poller - Feishu Task Board Polling Module
Periodically polls a Feishu task board and auto-executes tasks assigned to the current AI agent.
Author: socneo
Version: v1.0
"""
This code fetches document content from Feishu, which necessarily transmits task-board data over the network, but the file provides no user-facing disclosure beyond internal docstrings. Under the rule, network operations that transmit user or system data should have some visible warning, confirmation, or documented notice unless clearly covered by the skill description.
The append_feedback function performs a remote write by appending completion results to the Feishu document, affecting shared data. Although the function has an internal docstring, there is no visible confirmation, warning, or user-facing disclosure that task results will be posted back to the document.
该文件整体以中文编写，作为技能说明文档会默认将交互和配置指导限定在中文语境中。虽然 L007 提供了英文 README 链接，但当前文档本身未声明语言可选策略或用户可按偏好选择语言，可能与要求基于用户选择提供语言/locale 的组织策略不一致。
The configuration requires sensitive credentials such as app_id and app_secret, but the documentation does not warn about secure secret storage, file permissions, or avoiding accidental commits of config.json. This increases the chance of credential exposure through source control, logs, or insecure local storage.
The code formats timestamps with toLocaleString('en-US', ...), which forces U.S. English output regardless of user preference. This is a natural-language/locale policy issue because the skill does not offer a language or locale choice or document why English is required.