Feishu Docx Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:03 AM UTC
• Version: 1.1.0

Overview

This Feishu document CLI is mostly purpose-aligned, but it can overwrite shared documents and change collaborator access without clear safeguards.

Review this before installing if the Feishu documents are shared or business-critical. Use it only with a Feishu app and account intended for document automation, double-check document tokens and member IDs, and avoid running overwrite or permission-changing commands unless you are prepared for content loss or access changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description and code are broadly aligned on the main domain: this is indeed a Feishu document management CLI with document CRUD-like operations, image upload support, and permission API methods. However, there is a material description/behavior mismatch because several highlighted selling points are overstated or not actually available in the supplied code path. The code does not provide the claimed 'intelligent error prompts' explaining missing permissions and fixes; it mainly forwards API messages or generic exceptions. More importantly, permission management is presented as a core capability, but the CLI does not execute add/list/remove permission actions—it just prints 'Permission commands need doc_token parameter fix'. Similarly, list-blocks is exposed in the CLI but unusable due to missing argument handling. Image upload exists, but only by targeting or discovering an already existing image block, so it is less complete than the marketing language suggests. Therefore the declared description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence

Finding

Most of the declared core functionality is accurately represented: the code creates documents, reads raw content, overwrites/appends markdown content, uploads local images, and manages collaborator permissions. However, an important advertised differentiator is missing: there is no logic that interprets permission failures and tells the user which permission is missing or how to fix it. The script largely prints returned API messages directly. Also, 'automatic authorization management' is overstated, since permission changes are exposed as explicit CLI actions rather than automated handling. There are no obvious unrelated or hidden capabilities beyond the Feishu document management scope, but the description overstates error intelligence and automation enough to count as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The documented batch_delete operation can remove document content based on caller-controlled indices, making it a destructive primitive if exposed through an agent or CLI without validation and confirmation. Because the skill frames itself as full lifecycle management, an attacker or mistaken prompt could cause large-scale deletion of document contents, leading to integrity loss and operational disruption.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

{"children": [...]}

删除内容

DELETE /docx/v1/documents/{doc_token}/blocks/{doc_token}/children/batch_delete {"start_index": 0, "end_index": N}

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The documented permission-member delete endpoint enables removal of document access for arbitrary member IDs, which is a high-risk authorization-changing action if driven by untrusted parameters. In this skill's context, permission management is a core feature, so weak safeguards could be abused to revoke access from legitimate collaborators or facilitate denial of access and workflow disruption.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

{"member_type": "openid", "member_id": "...", "perm": "view/edit/full_access"}

移除权限

DELETE /docx/v1/documents/{doc_token}/permission/member/delete?member_type=openid&member_id=...

text

## 常见问题

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-doc-manager.py (reported line 41)May include surrounding context.

python

return app_id, app_secret
    
    def _get_token(self) -> str:
        """Get tenant access token"""
        resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal", json={
            'app_id': self.app_id,
            'app_secret': self.app_secret

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents extensive network-capable operations against Feishu APIs but does not declare any tool scope or allowed-tools boundaries. In an agent setting, missing scope metadata weakens policy enforcement and can allow the skill to perform external requests without explicit review, especially since it can create documents, upload files, and alter sharing permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation promotes permission changes and destructive content operations without explicit warnings, confirmations, or safe-use guidance. In an agent-driven workflow, this raises the chance of accidental oversharing, unauthorized collaborator changes, or unintended content deletion because users may invoke commands without understanding their impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The client reads app credentials from a local config file and sends them to the remote token endpoint, but there is no user-facing notice, logging, or warning that local secrets are being used and transmitted. This matches the missing-warning criterion for sensitive credential access combined with network transmission in a code file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The write operation replaces all document content after calling _clear_document without any confirmation, dry-run, or safety interlock. In a CLI skill context, this creates a real integrity risk because a user or upstream agent can accidentally destroy document contents with a single command, especially when document tokens are passed programmatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The parser and help text declare working permission-management subcommands such as list/add/remove, matching the skill's documented 'automatic authorization management' capability. However, the runtime branch for permissions only prints a placeholder message about needing a parameter fix and never calls list_permissions, add_permission, or remove_permission, so the inline command documentation contradicts actual behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-doc-manager.py (reported line 42)May include surrounding context.

python

app_id = config['channels']['feishu']['appId']
    app_secret = config['channels']['feishu']['appSecret']
    
    resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal",
        json={'app_id': app_id, 'app_secret': app_secret})
    return resp.json()['tenant_access_token']

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-doc.py (reported line 25)May include surrounding context.

python

app_id = config['channels']['feishu']['appId']
    app_secret = config['channels']['feishu']['appSecret']
    
    resp = requests.post(f"{FEISHU_API}/auth/v3/tenant_access_token/internal",
        json={'app_id': app_id, 'app_secret': app_secret})
    return resp.json()['tenant_access_token']

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The write command deletes existing document blocks and replaces them with converted content, but provides no confirmation, dry-run, backup, or explicit warning that the operation is destructive. In a CLI that manages real collaboration documents, a mistyped token or wrong file can cause immediate irreversible content loss or corruption of shared business data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI registers list-blocks with help text implying an operational command, but the execution branch explicitly states 'This needs doc_token' and exits with a usage message instead of invoking list_blocks. This is a direct contradiction between the command-level documentation and the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The permissions add/remove actions change document access control with no user-facing warning, confirmation, or validation beyond argument parsing. This can accidentally grant excessive access such as full_access to the wrong member or remove legitimate collaborators, causing unauthorized disclosure or operational disruption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.