Feishu Docx Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:03 AM UTC
• Version: 1.1.0

Overview

This Feishu document CLI is mostly purpose-aligned, but it can overwrite shared documents and change collaborator access without clear safeguards.

Review this before installing if the Feishu documents are shared or business-critical. Use it only with a Feishu app and account intended for document automation, double-check document tokens and member IDs, and avoid running overwrite or permission-changing commands unless you are prepared for content loss or access changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description and code are broadly aligned on the main domain: this is indeed a Feishu document management CLI with document CRUD-like operations, image upload support, and permission API methods. However, there is a material description/behavior mismatch because several highlighted selling points are overstated or not actually available in the supplied code path. The code does not provide the claimed 'intelligent error prompts' explaining missing permissions and fixes; it mainly forwards API messages or generic exceptions. More importantly, permission management is presented as a core capability, but the CLI does not execute add/list/remove permission actions—it just prints 'Permission commands need doc_token parameter fix'. Similarly, list-blocks is exposed in the CLI but unusable due to missing argument handling. Image upload exists, but only by targeting or discovering an already existing image block, so it is less complete than the marketing language suggests. Therefore the declared description does not accurately represent the actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: Most of the declared core functionality is accurately represented: the code creates documents, reads raw content, overwrites/appends markdown content, uploads local images, and manages collaborator permissions. However, an important advertised differentiator is missing: there is no logic that interprets permission failures and tells the user which permission is missing or how to fix it. The script largely prints returned API messages directly. Also, 'automatic authorization management' is overstated, since permission changes are exposed as explicit CLI actions rather than automated handling. There are no obvious unrelated or hidden capabilities beyond the Feishu document management scope, but the description overstates error intelligence and automation enough to count as a description-behavior mismatch.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"children": [...]}

# 删除内容
DELETE /docx/v1/documents/{doc_token}/blocks/{doc_token}/children/batch_delete
{"start_index": 0, "end_index": N}
```

• Confidence: 92% confidence
• Finding: The documented batch_delete operation can remove document content based on caller-controlled indices, making it a destructive primitive if exposed through an agent or CLI without validation and confirmation. Because the skill frames itself as full lifecycle management, an attacker or mistaken prompt could cause large-scale deletion of document contents, leading to integrity loss and operational disruption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

{"member_type": "openid", "member_id": "...", "perm": "view/edit/full_access"}

# 移除权限
DELETE /docx/v1/documents/{doc_token}/permission/member/delete?member_type=openid&member_id=...
```

## 常见问题

• Confidence: 91% confidence
• Finding: The documented permission-member delete endpoint enables removal of document access for arbitrary member IDs, which is a high-risk authorization-changing action if driven by untrusted parameters. In this skill's context, permission management is a core feature, so weak safeguards could be abused to revoke access from legitimate collaborators or facilitate denial of access and workflow disruption.

Credential Access

High

• Category: Privilege Escalation

Content

return app_id, app_secret
    
    def _get_token(self) -> str:
        """Get tenant access token"""
        resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal", json={
            'app_id': self.app_id,
            'app_secret': self.app_secret

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents extensive network-capable operations against Feishu APIs but does not declare any tool scope or allowed-tools boundaries. In an agent setting, missing scope metadata weakens policy enforcement and can allow the skill to perform external requests without explicit review, especially since it can create documents, upload files, and alter sharing permissions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation promotes permission changes and destructive content operations without explicit warnings, confirmations, or safe-use guidance. In an agent-driven workflow, this raises the chance of accidental oversharing, unauthorized collaborator changes, or unintended content deletion because users may invoke commands without understanding their impact.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The client reads app credentials from a local config file and sends them to the remote token endpoint, but there is no user-facing notice, logging, or warning that local secrets are being used and transmitted. This matches the missing-warning criterion for sensitive credential access combined with network transmission in a code file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The `write` operation replaces all document content after calling `_clear_document` without any confirmation, dry-run, or safety interlock. In a CLI skill context, this creates a real integrity risk because a user or upstream agent can accidentally destroy document contents with a single command, especially when document tokens are passed programmatically.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The parser and help text declare working permission-management subcommands such as list/add/remove, matching the skill's documented 'automatic authorization management' capability. However, the runtime branch for `permissions` only prints a placeholder message about needing a parameter fix and never calls `list_permissions`, `add_permission`, or `remove_permission`, so the inline command documentation contradicts actual behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

app_id = config['channels']['feishu']['appId']
    app_secret = config['channels']['feishu']['appSecret']
    
    resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal",
        json={'app_id': app_id, 'app_secret': app_secret})
    return resp.json()['tenant_access_token']

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

app_id = config['channels']['feishu']['appId']
    app_secret = config['channels']['feishu']['appSecret']
    
    resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal",
        json={'app_id': app_id, 'app_secret': app_secret})
    return resp.json()['tenant_access_token']

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The write command deletes existing document blocks and replaces them with converted content, but provides no confirmation, dry-run, backup, or explicit warning that the operation is destructive. In a CLI that manages real collaboration documents, a mistyped token or wrong file can cause immediate irreversible content loss or corruption of shared business data.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The CLI registers `list-blocks` with help text implying an operational command, but the execution branch explicitly states 'This needs doc_token' and exits with a usage message instead of invoking `list_blocks`. This is a direct contradiction between the command-level documentation and the implemented behavior.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The permissions add/remove actions change document access control with no user-facing warning, confirmation, or validation beyond argument parsing. This can accidentally grant excessive access such as full_access to the wrong member or remove legitimate collaborators, causing unauthorized disclosure or operational disruption.

Static analysis

No suspicious patterns detected.