Feishu Doc Batch Export

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:49 AM UTC
• Version: 1.0.0

Overview

The skill mostly performs Feishu document export, but it overstates batch features, asks for broader Drive access than the shipped code needs, and downloads document-supplied image URLs without destination limits.

Review this skill before installing. Use it only with Feishu credentials scoped as narrowly as possible, avoid granting drive:readonly until folder export actually exists, export only documents you trust, and choose an output directory appropriate for sensitive local copies. Be aware that document image links can make the machine running the skill contact arbitrary HTTP(S) URLs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export.py:68

Finding

Unrestricted document-controlled image retrieval enables server-side request forgery

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:31

Finding

Unnecessary Feishu Drive permission requested for unimplemented folder export

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Open-ended dependency constraints prevent reproducible, reviewed installations

Content

View full analysis

=2.31.0 markdownify>=0.11.6 ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. An installation can therefore resolve to any later version published to the configured package index. The reviewed project source does not uniquely determine which third-party code will be installed or executed. No malicious package, dependency-confusion namespace, typosquatted name, or known vulnerable version was established during this audit. The issue is that future, compromised, incompatible, or insufficiently reviewed releases automatically remain eligible. This also reduces reproducibility: two users installing the same Skill at different times may receive materially different dependency versions. ### Attack Path 1. A future package release becomes available and satisfies the open-ended version constraint. 2. A user installs or reinstalls the Skill dependencies. 3. The package resolver selects the newer release. 4. The new package code executes during installation or when imported by `scripts/export.py`. 5. If that release is compromised or unsafe, it operates with the same filesystem, environment, and network privileges as the exporter. ### Impact Assessment The possible impact depends on the behavior of a future selected release. A compromised dependency could access environment variables, including the Feishu application credentials, read or modify files available to the process, and initiate network connections. This is a preventive supply-chain finding; the audit did not establish that the currently named packages or minimum versions are malicious. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'data' from os.getenv (line 28, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/export.py (reported line 30)May include surrounding context.

python

headers = {"Content-Type": "application/json; charset=utf-8"}
    data = {"app_id": APP_ID, "app_secret": APP_SECRET}
    
    response = requests.post(url, headers=headers, json=data)
    result = response.json()
    if result.get("code") != 0:
        raise Exception(f"获取token失败: {result.get('msg')}")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码总体方向与声明相近，确实是在导出飞书 docx 到本地 Markdown，并处理图片、本地保存、可选保留 HTML，因此不存在明显的额外越权或无关恶意行为。但声明中的核心能力“批量导出”“支持文件夹/文档链接批量导出”与实际实现不符：main() 中只要 URL 含有“docx/”就走单文档导出，否则直接提示“文件夹批量导出功能正在开发中，目前仅支持单个文档导出”。虽然参数中有 --recursive，但没有任何实际文件夹遍历逻辑。故这是明显的描述能力高于实际代码能力的情况，属于功能性不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises behavior that requires network access, reading credentials from environment variables, and writing files locally, but it declares no explicit tool scope or permissions. This weakens least-privilege controls and can cause an agent to invoke the skill with broader capabilities than the user expects, increasing the risk of unauthorized network requests or filesystem writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not clearly warn that it will persist exported document contents and downloaded images to local storage. Because the content may include sensitive internal documents, users may trigger the skill without realizing it creates local copies, which increases the risk of unintended data retention, exposure through backups/sync tools, or writing into unsafe locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file includes steps for configuring application credentials, including an app secret, but does not warn users that the secret is sensitive or should be protected from shell history, screenshots, shared terminals, or committing to files. Because markdown files should disclose behaviors affecting privacy or system integrity, the omission is a meaningful safety gap.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/export.py (reported line 30)May include surrounding context.

python

headers = {"Content-Type": "application/json; charset=utf-8"}
    data = {"app_id": APP_ID, "app_secret": APP_SECRET}
    
    response = requests.post(url, headers=headers, json=data)
    result = response.json()
    if result.get("code") != 0:
        raise Exception(f"获取token失败: {result.get('msg')}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The tool saves document contents and remotely referenced images to local disk automatically, but it does not clearly warn users that potentially sensitive document data and linked assets will be persisted. In an agent/skill context, this can lead to unintended retention of confidential information on shared machines or workspaces.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description says it supports batch export from specified folders or document links, but the code only handles URLs containing "docx/" as a single document. For non-document URLs, it prints that folder batch export is still under development, which directly falls short of the manifest's stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This file contains user-facing natural-language content that assumes a single language/locale for all users. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This file presents all user-facing natural-language content exclusively in Chinese, which can amount to a language/locale policy issue when no user opt-in or documented regional scope is provided. The content does not state that the skill or offering is limited to a Chinese-speaking audience or a China-specific compliance context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which makes builds non-reproducible and allows future installs to pull different versions than were tested. In a document-export skill that performs network requests, this increases supply-chain and stability risk and makes it impossible to verify whether a vulnerable or incompatible release is installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
markdownify>=0.11.6

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

requests has known advisories, and because the manifest does not pin a version, there is no assurance that deployments will avoid affected releases. In this skill, requests is likely used to fetch Feishu documents and related resources, so issues such as credential leakage, TLS/verification flaws, or redirect handling bugs could expose tokens or document data during network operations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

markdownify>=0.11.6 is also unpinned, so installations may resolve to different versions over time, including releases with undiscovered bugs or breaking behavior. Because this skill converts remote document content into Markdown, parser/converter dependencies are part of the trusted input-handling path and should be controlled precisely.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
markdownify>=0.11.6

Unverifiable Dependency: markdownify has 2 known advisory(ies) (CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

markdownify has known advisories, and without version pinning the installed version may still be vulnerable. Given this skill processes potentially large or untrusted document content and converts it to Markdown, parser-related flaws could enable denial of service or malformed output generation if a vulnerable release is resolved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing strings such as argument descriptions, status messages, and errors are consistently in Chinese, and the script does not provide any opt-in, locale selection, or justification for this language constraint. This can violate a language/locale policy when skills are expected to be usable without forcing a specific language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description promises preservation of formatting, images, and links, but the implementation relies on a generic HTML-to-Markdown conversion and only performs explicit post-processing for image URLs. There is no code verifying or enforcing preservation of links or broader formatting fidelity, so the implementation is weaker than the manifest suggests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.