T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync-feishu-wiki.sh:30- Finding
Feishu application secret exposed through process arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Multilingual KB Sync
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate knowledge-base sync purpose, but its scripts can publish arbitrary local files to Feishu or GitHub without strong scoping or confirmation.
Install only if you trust the workflow and will run it manually with reviewed inputs. Use least-privileged Feishu and GitHub credentials, restrict it to intended kb-templates files and approved repositories/wiki spaces, preview content before publishing, and avoid running it in shared or logged environments until credential handling is improved.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create-github-issue.sh:32- Finding
GitHub token exposed through process arguments
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/sync-feishu-wiki.sh:15- Finding
Arbitrary readable local files can be uploaded to Feishu Wiki
- Content
View full analysis
[wiki-space-id] [parent-node-token]}" ``` ```bash if [[ ! -f "$FILE_PATH" ]]; then echo "Error: file not found: $FILE_PATH" >&2 exit 1 fi ``` ```bash CONTENT=$(cat "$FILE_PATH") BLOCKS_PAYLOAD=$(jq -n \ --arg text "$CONTENT" \ '{ children: [ { block_type: 2, text: { elements: [{ text_run: { content: $text } }], style: {} } } ], index: 0 }') curl -s -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "$BLOCKS_PAYLOAD" | jq . ``` ### Technical Analysis The script accepts any path that passes the `-f` check and uploads its entire contents to Feishu. It does not: - Restrict the path to the documented `kb-templates/` directory. - Resolve and validate the canonical path. - Reject symbolic links that resolve outside an approved directory. - Detect likely credential or configuration files. - Preview the selected file and destination or request confirmation before publication. The `-f` check establishes only that the supplied path refers to a regular file. It does not establish that the file is an authorized template. ### Attack Path 1. An attacker influences the file-path argument through malicious repository instructions, automation input, or social engineering. 2. The attacker supplies a path to a sensitive file readable by the account running the script, such as a project `.env` or private configuration file. 3. The file passes the regular-file check. 4. The script reads the entire file with `cat`. 5. The content is embedded into a Feishu block payload and uploaded using the configured application cre ...[truncated 600 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/create-github-issue.sh:15- Finding
Arbitrary readable local files can be published as GitHub issue bodies
- Content
View full analysis
<body-file>}" TITLE="${2:?Usage: $0 <owner/repo> <title> <body-file>}" BODY_FILE="${3:?Usage: $0 <owner/repo> <title> <body-file>}" if [[ ! -f "$BODY_FILE" ]]; then echo "Error: body file not found: $BODY_FILE" >&2 exit 1 fi ``` ```bash if command -v gh &>/dev/null && gh auth status &>/dev/null; then gh issue create \ --repo "$REPO" \ --title "$TITLE" \ --body-file "$BODY_FILE" \ --label "documentation" \ --label "i18n" else # Fallback to API : "${GITHUB_TOKEN:?Set GITHUB_TOKEN or authenticate with 'gh auth login'}" BODY=$(cat "$BODY_FILE") curl -s -X POST \ -H "Authorization: token $GITHUB_TOKEN" \ -H "Content-Type: application/json" \ -d "$(jq -n --arg t "$TITLE" --arg b "$BODY" \ '{title: $t, body: $b, labels: ["documentation", "i18n"]}')" \ "https://api.github.com/repos/$REPO/issues" | jq -r '.html_url' fi ``` ### Technical Analysis The body-file argument may identify any regular file readable by the invoking account. Both execution paths publish that file: - The `gh` path sends it directly using `--body-file`. - The fallback path reads it with `cat` and places it in a GitHub API request. The script does not constrain the body file to generated issue-body files or an approved project directory. It also does not validate the canonical path, reject symlinks, check repository visibility, or request confirmation before publication. ### Attack Path 1. An attacker influences the repository or body-file arguments. 2. The body-file argument is set to a readable sensitive file. 3. The regular-file check succeeds. 4. The authenticated `gh` CLI or fallback API client creates an issue containing the file’s contents. 5. Anyone with access to the target repos ...[truncated 663 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill advertises a full multilingual synchronization pipeline, but the documented behavior is largely procedural guidance and delegates critical actions to external scripts without demonstrating the claimed translation, validation, GitHub orchestration, or end-to-end sync controls. This mismatch can mislead operators into granting trust or broad access under false assumptions, increasing the chance of unsafe execution or unintended data publication.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # create-github-issue.sh <repo> <title> <body-file> # # Environment: # GITHUB_TOKEN — GitHub personal access token (required if gh not authed) # # Requirements: gh (GitHub CLI) or curl + jq
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # create-github-issue.sh <repo> <title> <body-file> # # Environment: # GITHUB_TOKEN — GitHub personal access token (required if gh not authed) # # Requirements: gh (GitHub CLI) or curl + jq
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # create-github-issue.sh <repo> <title> <body-file> # # Environment: # GITHUB_TOKEN — GitHub personal access token (required if gh not authed) # # Requirements: gh (GitHub CLI) or curl + jq
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
On authentication failure, the script prints the full token response to stderr, and such responses can include sensitive diagnostic or token material depending on API behavior. In CI logs, agent traces, or shared terminals, this can leak credentials or internal error details to unintended viewers.
- Content
sh TOKEN=$(echo "$TOKEN_RESP" | jq -r '.tenant_access_token') if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then echo "Error: failed to get tenant access token: $TOKEN_RESP" >&2 exit 1 fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to run shell commands that can modify local files, push to GitHub, and invoke external sync scripts, but it does not declare any explicit tool scope or allowed-tools boundaries. This creates an authorization gap where a caller or downstream agent may execute powerful side-effecting operations without clear least-privilege constraints or review expectations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Authentication
bash curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # Environment: # GITHUB_TOKEN — GitHub personal access token (required if gh not authed) # # Requirements: gh (GitHub CLI) or curl + jq set -euo pipefail
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The script reads arbitrary contents from
BODY_FILEand transmits them tohttps://api.github.com/repos/$REPO/issues, creating an external data egress path. In the context of a knowledge-base sync skill, this can leak sensitive internal template text, customer support content, or embedded secrets if untrusted or overly broad files are provided as input.- Content
sh -H "Content-Type: application/json" \ -d "$(jq -n --arg t "$TITLE" --arg b "$BODY" \ '{title: $t, body: $b, labels: ["documentation", "i18n"]}')" \ "https://api.github.com/repos/$REPO/issues" | jq -r '.html_url' fi
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # --- 1. Get tenant access token --- TOKEN_RESP=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh parent_node_token: ($parent | select(. != "") // empty) }') CREATE_RESP=$(curl -s -X POST 'https://open.feishu.cn/open-apis/wiki/v2/spaces/.../nodes' \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "$CREATE_PAYLOAD")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script reads an arbitrary local file and uploads its full contents to Feishu without any confirmation, allowlist, or classification check. In an agent skill context, this is risky because a user or downstream automation could unintentionally sync sensitive local files to an external SaaS platform, causing data exfiltration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This request transmits the complete local file content to Feishu, which is an external data transfer and the core risky behavior in the script. In an agent skill that may operate on user-provided paths or automation inputs, this can leak sensitive files to an external service without sufficient guardrails or user acknowledgement.
- Content
sh index: 0 }') curl -s -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "$BLOCKS_PAYLOAD" | jq .
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file includes a concrete curl example that sends
app_idandapp_secretto an authentication endpoint, but it provides no accompanying warning about using sensitive credentials or avoiding exposure in shell history and shared terminals. Under the markdown-specific warning criterion, examples involving credentials should disclose privacy or security implications when omitted entirely.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The script requires FEISHU_APP_ID and FEISHU_APP_SECRET and uses them to obtain an access token for API calls. Although this is functionally necessary, the file only lists the variables and does not include any warning or guidance that these are sensitive credentials or should be protected.
- Content
Static analysis
No suspicious patterns detected.