Security audit

doc-review-Auuu

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its Feishu document-review purpose, but it asks for broad remote write authority and includes unsafe or under-scoped instructions that users should review before installing.

Install only if you are comfortable granting Feishu document read/write access and having reports plus document/link metadata stored in Feishu. Before use, require confirmation of the exact source documents, destination folder, summary-table token, and whether overwrite updates are allowed; remove or vendor the external material-review reference before trusting the external-material workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: prompts/对外材料.md:30
Finding: Untrusted Cross-Skill Instruction Delegation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Mandatory Permission Check Performs an Unnecessary Remote Write and Misclassifies Errors
Content: View full analysis
&1 | grep -i "permission" && echo "✓ 读取权限OK" || echo "✗ 缺少读取权限" # 测试文档创建/写入 lark-cli docs +create --title "权限测试" --markdown "测试" 2>&1 | grep -i "permission" && echo "✓ 写入权限OK" || echo "✗ 缺少写入权限" ``` ### Technical Analysis The mandatory write-permission test invokes `docs +create` without a documented dry-run option. It can therefore create an actual Feishu document whenever the preflight check runs. This remote mutation is unnecessary for determining authorization status and exceeds the minimum action required for a permission check. The result handling is also inverted or ambiguous. The pipeline reports success whenever output contains the word `permission`, even though permission-denied errors commonly include that word. Since the pipeline evaluates `grep` rather than reliably checking the original CLI exit status and structured response, an error can be presented as a successful permission check. ### Attack Path 1. A user invokes any review because permission preflight is mandatory. 2. The Skill runs `lark-cli docs +create`. 3. A test document is created in the user's Feishu environment if authorization succeeds. 4. Alternatively, the CLI returns an error containing the word `permission`. 5. `grep` matches that word and prints a false success message. 6. The workflow continues under an incorrect authorization assumption or leaves unnecessary documents behind. ### Impact Assessment The Skill can create unwanted documents using the user's `docx:document:write_only` authorization. Repeated invocation may produce persistent document clutter. False-positive permission checks can cause incorrect workflow behavior and confusing failures later in the review. The finding ...[truncated 123 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:41
Finding: Unpinned Global Installation of a Privileged Runtime Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: OPTIMIZATION_SUMMARY.md:96
Finding: Unsafe Reconstruction and Destructive Overwrite of the Remote Summary Table
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The plan explicitly recommends collecting multiple document read/create/write scopes up front and even provides a combined authorization command, but it does not require clear user consent messaging about what data may be read or modified. In the context of a document-review skill that processes user-supplied documents and writes reports into Feishu, this increases privacy and integrity risk because the skill can access document contents and create or alter documents more broadly than the user may expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guidance recommends using --mode overwrite to rewrite the full summary table after appending a new row, but it does not emphasize that overwrite is destructive if the wrong document token, malformed content, or partial fetch result is used. In this skill, which must create or update shared Feishu documents as a required deliverable, that omission can lead to accidental data loss or unintended modification of existing records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown proposes reading an existing summary document and then rewriting it with an appended record using overwrite mode, but it does not require explicit user confirmation, backup, conflict checks, or validation that the target document is the intended one. In this skill context, the agent is expected to create or update Feishu documents, so undocumented overwrite behavior creates a realistic risk of accidental data loss or corruption of an existing shared summary table.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file is entirely written as mandatory operational guidance in Chinese, including agent-facing instructions like '必须先创建' and user-facing expectations, but it does not mention any user opt-in for language preference. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level description says the skill will create a Feishu review document and create or update a summary table, but it does not clearly warn users that this involves external writes and may overwrite shared summary content. Because later instructions require overwrite-mode updates to a shared historical table, users may not meaningfully understand the persistence and modification side effects before invoking the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase list includes broad everyday wording such as “审查文档” and “doc review”, which can cause the skill to activate in contexts where the user did not intend external Feishu reads/writes. In this skill, unintended activation is more dangerous because execution flow mandates credential checks, document access attempts, and report/summary document creation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to preserve and rewrite complete historical review records, including original document URLs and AI conversation links, into a shared summary document. This creates unnecessary cross-session aggregation of potentially sensitive links and metadata, expands the blast radius of any access mistake, and can leak prior users' information to later viewers of the shared summary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt directs the agent to create, populate, move, and log a Feishu cloud document, but it does not require explicit user consent or a user-facing disclosure that document contents will be transmitted to an external service. Because the reviewed material may include unpublished research, internal evaluation plans, or sensitive project details, this can cause unintended data exfiltration or persistence outside the chat context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 该描述使用了“当需要审查、检查或评估任何对外发布的材料时使用此技能”以及“只要用户提到…立即使用此技能”这类宽泛激活条件，覆盖面非常大，且“审查文件”等表述缺乏明确边界。文件虽给出若干示例短语，但没有排除条件或负例，容易在一般性文档检查场景中被误调用。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to create a Feishu cloud document and store the review report without warning the user that submitted content and analysis will be persisted to an external platform. Because this skill reviews potentially confidential external materials, silent storage increases the risk of unintended data disclosure, policy violations, and user surprise about where sensitive content is retained.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt gives conflicting storage destinations for the generated Feishu review document: earlier it says reports for external materials should be moved to 审查报告/对外材料/, but the later operational steps instruct moving the file to 审查报告/文献调研/. This can cause sensitive external-review content to be misfiled into the wrong knowledge base location, weakening access control, retention, and audit expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill name, description, folder applicability, operational instructions, and report template are all written to operate in Chinese, including Chinese titles and output structure, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to create, write, move, and log Feishu cloud documents, which causes user-supplied content and generated analysis to be sent to an external service. Because the prompt does not require explicit user consent, data classification checks, or a warning about external persistence, sensitive or proprietary document contents could be exfiltrated or stored unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to create a Feishu document, move it into a knowledge base, and record the link in a summary table, but it does not require explicit user awareness or confirmation before writing potentially sensitive review content to external systems. Because this skill processes user-provided documents and public links, the generated report may contain confidential architecture, security, or business information that gets persisted and shared beyond the chat context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly states that the skill will create or update Feishu documents and summary tables, but it does not clearly warn the user that invoking the skill can modify remote data in their workspace. This can lead to unintended writes, overwrites, or record creation in a connected tenant, especially when users provide links or content without realizing the skill performs side effects beyond chat output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description and all prescribed user-facing messages are written as mandatory Chinese outputs, and the document does not offer any language or locale choice. This can violate language-choice policy when the skill is not explicitly limited to a Chinese-only regional context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: All natural-language instructions, descriptions, and output requirements are expressed in Chinese, which can effectively force a specific language for interaction and outputs. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Recording the newly created Feishu document link into a summary table creates an additional persistent and traceable record, but the prompt does not disclose this side effect to the user. While lower impact than storing the full report, it still expands metadata visibility and can expose the existence, title, and location of sensitive reviews to broader audiences than expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The natural-language instructions and report template consistently require Chinese-language operation and output, but the file does not indicate that this locale is optional or limited to a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This is a manifest file, so vague-trigger checks apply. The description explains what the skill does but does not define clear trigger phrases, activation boundaries, or exclusion conditions, which can make it unclear when the skill should be invoked versus ordinary document-help requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.