Smart Poller

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:47 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Feishu task-board poller, but it can run persistently and write completion records to a shared document based on external task text without approval or real task verification.

Review before installing. Use this only with a trusted, access-restricted Feishu task board and a least-privilege Feishu app. Treat the current implementation as a polling and acknowledgement tool, not a real autonomous task executor. Test with --once first, protect config.json from source control and broad file permissions, and avoid cron/continuous mode unless you add approval, audit logging, and clear rules for who may create tasks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

console.log('='.repeat(60));

    try {
        // Step 1: get access token
        console.log('\n1️⃣  Getting Feishu token...');
        const token = await getTenantAccessToken();

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Smart Poller

> Periodically polls a Feishu (Lark) task board and auto-executes tasks assigned to the current AI agent.

**Version**: v1.0 | **Author**: socneo | **Category**: automation

• Confidence: 98% confidence
• Finding: The phrase 'auto-executes tasks assigned to the current AI agent' describes autonomous decision-making driven by content from an external collaborative document. Because task definitions can be modified by other parties, this creates a direct path for prompt injection, unauthorized action triggering, or execution of harmful workflows without human review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README openly advertises that the skill will poll a shared Feishu document, automatically execute tasks assigned to the agent, and write results back, but it does not provide an explicit safety warning about the trust boundary or the risks of executing document-sourced instructions. In this context, the task board is effectively a remote command source, so lack of clear warning and consent guidance increases the chance users deploy an autonomous executor against untrusted or broadly writable content.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Edit crontab
crontab -e

# Run every 15 minutes
*/15 * * * * cd /path/to/smart_poller && python3 poller.py config.json --once

• Confidence: 85% confidence
• Finding: The cron example encourages persistent periodic execution, which turns any unsafe task-ingestion behavior into a continuously exploitable channel. In combination with automatic task execution from Feishu, persistence increases exposure time and allows repeated triggering of malicious or mistaken tasks without active operator presence.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes periodic polling of a Feishu task board and automatic write-back of task results, but it does not clearly warn users that the skill continuously reads from and modifies an external document on an ongoing basis. In an automation skill, this matters because users may deploy it without understanding the persistence, data access, and autonomous action scope, increasing the risk of unintended data exposure or unauthorized document changes.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Cron 定时（推荐生产环境）

```bash
crontab -e
# 每 15 分钟执行一次
*/15 * * * * cd /path/to/smart_poller && python3 poller.py config.json --once
```

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Smart Poller Skill

**Smart Polling Skill** — Periodically polls a Feishu task board and auto-executes tasks assigned to the current AI agent.

📖 [中文文档](README.zh-CN.md)

• Confidence: 94% confidence
• Finding: The phrase 'auto-executes tasks assigned to the current AI agent' describes autonomous decision-making tied to externally sourced task content. In this context, the danger is elevated because scheduled polling plus automatic execution can create a continuous remote-command channel, enabling prompt injection, unsafe tool use, or unintended actions without human review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly states that it will poll a Feishu task board, auto-execute assigned tasks, and write completion feedback, but it does not present this behavior as a prominent security warning or explain the trust boundary. That omission is dangerous because users may install it without understanding that external task-board content can directly drive local code or agent actions on a recurring basis.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The header states this is a polling script that 'executes tasks assigned to the current agent.' However, executeTask only inspects the task description for keywords like 'test', 'search', or 'monitor' and returns fixed strings without performing any real task-specific operation. This is an active mismatch between the documented intent and actual behavior.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The script writes completion-style feedback to the shared Feishu document even though no real task completion is verified. In an agent/task-board workflow, this can create false audit records, mislead other actors into believing work was performed, and enable task-state spoofing or operational bypass.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring says it 'auto-executes tasks assigned to the current AI agent,' and the main poller docstring repeats that it 'executes tasks.' In practice, execute_task only matches a few keywords and returns fixed messages, while poll merely appends those messages back to the Feishu document rather than performing the requested task actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# -*- coding: utf-8 -*-
"""
Smart Poller - Feishu Task Board Polling Module
Periodically polls a Feishu task board and auto-executes tasks assigned to the current AI agent.
Author: socneo
Version: v1.0
"""

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This code fetches document content from Feishu, which necessarily transmits task-board data over the network, but the file provides no user-facing disclosure beyond internal docstrings. Under the rule, network operations that transmit user or system data should have some visible warning, confirmation, or documented notice unless clearly covered by the skill description.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The append_feedback function performs a remote write by appending completion results to the Feishu document, affecting shared data. Although the function has an internal docstring, there is no visible confirmation, warning, or user-facing disclosure that task results will be posted back to the document.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: 该文件整体以中文编写，作为技能说明文档会默认将交互和配置指导限定在中文语境中。虽然 L007 提供了英文 README 链接，但当前文档本身未声明语言可选策略或用户可按偏好选择语言，可能与要求基于用户选择提供语言/locale 的组织策略不一致。

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The configuration requires sensitive credentials such as app_id and app_secret, but the documentation does not warn about secure secret storage, file permissions, or avoiding accidental commits of config.json. This increases the chance of credential exposure through source control, logs, or insecure local storage.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The code formats timestamps with `toLocaleString('en-US', ...)`, which forces U.S. English output regardless of user preference. This is a natural-language/locale policy issue because the skill does not offer a language or locale choice or document why English is required.

Static analysis

No suspicious patterns detected.