Feishu Master

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:14 AM UTC
• Version: 1.0.0

Overview

This Feishu API skill is coherent but needs review because it stores and prints Feishu tokens and tells agents to create and run new Feishu API scripts, including destructive actions, without clear approval boundaries.

Install only if you are comfortable giving an agent Feishu app credentials and potentially broad Feishu API authority. Use a test Feishu app with minimal scopes, avoid production groups until scripts are reviewed, protect scripts/env/app.json and token_cache.json with strict local permissions, do not log token output, and require explicit human confirmation before any send, update, delete, admin, or bulk data operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_token.py:89

Finding

Feishu credentials and access tokens are stored in plaintext without enforced file permissions

Content

View full analysis

app.json ``` ### Technical Analysis The application secret is stored in `scripts/env/app.json`, and the resulting tenant access token is stored in `scripts/env/token_cache.json`. Both are plaintext files. `Path.write_text()` creates the token cache using permissions derived from the process umask. The code does not explicitly enforce owner-only permissions such as `0600`, does not securely create the file, and does not use a secret-management facility. The development documentation claims that `scripts/.gitignore` protects `app.json` and `token_cache.json`, but no such file is present in the audited project. This increases the chance that credentials will be committed to version control or included in an archive. The network transmission of `app_id` and `app_secret` itself is expected and necessary: it uses HTTPS and targets the declared official Feishu endpoint. The finding concerns local storage rather than evidence of exfiltration. ### Attack Path 1. A user follows the setup instructions and creates `scripts/env/app.json`. 2. `get_token.py` obtains a tenant token and writes it to `scripts/env/token_cache.json`. 3. The files inherit ambient filesystem permissions ins ...[truncated 948 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_token.py:115

Finding

Bearer token is exposed through process standard output

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:3

Finding

Third-party dependency is not reproducibly pinned

Content

View full analysis

=2.31.0 ``` ### Technical Analysis The dependency declaration accepts version `2.31.0` and every later release. Consequently, installations performed at different times may resolve to different package versions. The project does not provide a lock file or package hashes. This prevents reproducible dependency verification and means future dependency changes can enter the runtime without a corresponding Skill review. No evidence was found that the current `requests` package is malicious or that the project uses a typosquatted package. The risk arises from unrestricted future resolution and lack of artifact integrity verification. ### Attack Path 1. A user or automated environment installs the project dependencies. 2. The package resolver selects a newer release than the version previously audited. 3. A compromised, unexpectedly changed, or incompatible release is downloaded because it satisfies `requests>=2.31.0`. 4. The package is installed and imported by the Skill scripts. 5. Unsafe package behavior executes with the privileges of the Skill process or changes the security properties of Feishu network requests. ### Impact Assessment A compromised dependency could access the same process environment, local files, Feishu credentials, and bearer tokens available to the Skill. It could also intercept or alter outbound API requests. The practical severity is reduced because `requests` is a well-known package from the expected ecosystem and no active compromise was identified during this static audit. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

BASE_URL = "https://open.feishu.cn"

def get_token():
    """Get Feishu access token"""
    result = subprocess.run(
        [sys.executable, str(TOKEN_SCRIPT)],
        capture_output=True,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes capabilities that include reading and writing files, making network requests, and executing shell commands, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, that omission makes it easier for the skill to be invoked with broader-than-expected authority and reduces auditability of what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's stated model is to implement new Feishu API functionality on demand, then execute and test it immediately. That creates a self-modifying, action-taking workflow where the agent can expand its own capabilities at runtime, including for destructive endpoints such as message deletion, without prior review or fixed boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The workflow explicitly tells the agent to generate new Python scripts, persist them, and then execute them if no existing script matches. Persistent code generation inside a skill materially increases risk because prompts, documentation, or task input can influence newly created executable logic, effectively broadening the attack surface beyond the original skill definition.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples explicitly normalize destructive operations such as deleting messages as a standard extension path for the skill. Because the manifest only generically describes 'leveraging Feishu capabilities,' users and operators may not realize that the skill can be extended to modify or delete external data, creating a scope/expectation mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented flow instructs the AI to implement and execute actions like message deletion without any user-facing confirmation, dry-run mode, or warning that external state will be changed. In an agent context, this can lead to accidental or prompt-induced destructive actions against real Feishu resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes obtaining an access token using app_id and app_secret and later using the resulting Bearer token, but it does not warn readers that these values are sensitive secrets that should not be exposed, logged, or shared. Under the markdown-specific missing-warning rule, credential-handling behavior that affects privacy or system integrity should include a user-facing warning.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/get_group_members.py (reported line 74)May include surrounding context.

python

def get_token():
    """获取飞书 token"""
    result = subprocess.run(
        [sys.executable, str(TOKEN_SCRIPT)],
        capture_output=True,
        text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This script retrieves and prints group member information, including identifiers and names, directly to stdout without any minimization, redaction, or warning about sensitive personal data exposure. In agent or automation contexts, stdout is often logged, persisted, or forwarded to other tools, which can unintentionally disclose member lists and identifiers beyond the intended recipient.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, usage notes, and subsequent user-facing output are written entirely in Chinese, which imposes a specific language on users without opt-in. The file does not state that this skill is intended only for Chinese-speaking users or a China-specific environment, so this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_token.py (reported line 73)May include surrounding context.

python

def request_new_token(app_id, app_secret):
    """请求新 token"""
    response = requests.post(
        TOKEN_URL,
        json={
            "app_id": app_id,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L141 明确要求 description 为“脚本功能描述（中文）”，属于语言/locale 约束。文档中未说明这是面向特定中文环境的限定，也未提供其他语言或用户选择，因此构成自然语言层面的语言政策风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This plain-text file uses Chinese for all headings and descriptions, which can impose a language constraint on users without any visible opt-in or explanation. The policy explicitly flags forced language or locale choices in natural-language content across all file types.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future major or minor release to be installed. This harms reproducibility and can silently introduce vulnerable or incompatible versions through normal installs or rebuilds, especially in an API-integration skill that likely performs outbound HTTP requests and may handle tokens or other sensitive data.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# Feishu Skill Python Dependencies

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because the manifest does not pin requests to an exact version, it is impossible to verify from this file whether the installed release includes fixes for known advisories. In a Feishu API skill, requests is likely used for authenticated network communication, so installing an affected version could expose credentials, request integrity, or other sensitive API interactions depending on which version resolves at install time.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions, parameter descriptions, and examples are presented exclusively in Chinese. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest text describes the script entirely in Chinese ("获取指定飞书群组的成员列表") and the usage hint provides no indication that language choice is optional. Under the policy, a forced language or locale without user opt-in or clear region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.