multilingual-template-sync

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but its Feishu sync script can send credentials and file contents to a configurable external API URL without validation.

Review before installing. Use only in trusted workspaces, set Feishu and GitHub credentials with least-privilege scopes, verify FEISHU_BASE_URL is unset or points to the official Feishu API, and confirm the exact file, Wiki node, and repository before running sync or issue commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu_wiki_sync.sh:13

Finding

Unvalidated Feishu API Base URL Can Expose Credentials and Uploaded File Content

Content

View full analysis

&2 exit 1 fi # 2. Read file content CONTENT=$(cat "$FILE") # 3. Create or update Wiki document # This is a simplified example — production use should convert Markdown # to Feishu Docx blocks via the docx API. PAYLOAD=$(jq -n \ --arg title "Common Responses" \ --arg content "$CONTENT" \ '{title: $title, content: $content}') HTTP_CODE=$(curl -s -o /tmp/feishu_resp.json -w "%{http_code}" \ -X POST "${FEISHU_BASE_URL}/wiki/v2/spaces/${SPACE_ID}/nodes/${NODE_TOKEN}/docs" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -d "$PAYLOAD") ``` ### Technical Analysis The script accepts `FEISHU_BASE_URL` directly from the execution environment without validating its scheme or hostname. It subsequently sends the Feishu application ID and secret to a token endpoint derived from that value. After receiving a response, the script extracts `.tenant_access_token` without verifying that the response originated from an approved Feishu domain. It then sends that token and the complete contents of the user-selected file to another endpoint under the same configurable base URL. Consequently, any party capable of influencing the environment used to execute the script can redirect both requests to an attacker-controlled service. HTTPS alone does not prevent this atta ...[truncated 1694 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu_wiki_sync.sh:59

Finding

Predictable Feishu Response File Permits Symlink-Based File Overwrite

Content

View full analysis

&2 cat /tmp/feishu_resp.json >&2 exit 1 fi ``` ### Technical Analysis The script writes the HTTP response to the fixed path `/tmp/feishu_resp.json`. Shared temporary directories are normally writable by other local users. Although directory-level protections may prevent one user from deleting another user's files, they do not prevent an attacker from creating the predictable path first as a symbolic link. When `curl -o` opens that path, it can follow a pre-existing symbolic link and truncate or overwrite the linked target using the permissions of the account running the script. The script neither creates the file atomically nor verifies its ownership and file type. The predictable filename also allows concurrent script invocations under the same account to overwrite and read each other's response data. ### Attack Path 1. A local attacker predicts that a victim will run the Feishu synchronization script. 2. Before execution, the attacker creates `/tmp/feishu_resp.json` as a symbolic link to a file writable by the victim account. 3. The victim executes the script. 4. `curl -o /tmp/feishu_resp.json` follows the symbolic link. 5. The target file is truncated and replaced with the Feishu HTTP response. 6. If the request fails, the script may also print content from a response file altered by another concurrent process. ### Impact Assessmen ...[truncated 533 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/github_issue.sh:56

Finding

Predictable GitHub Response File Permits Symlink-Based File Overwrite

Content

View full analysis

&2 cat /tmp/gh_resp.json >&2 exit 1 fi ``` ### Technical Analysis The GitHub fallback implementation stores its API response in the fixed shared path `/tmp/gh_resp.json`. The path is not securely and atomically created, and the script does not check whether it is a regular file owned by the invoking user. A local attacker can pre-create this predictable pathname as a symbolic link to another file. The subsequent `curl -o` operation can follow that link and overwrite the target with the GitHub API response. Multiple simultaneous invocations can also interfere with one another because all runs share the same response path. The GitHub token is sent only to the fixed official API hostname in this code, so the finding concerns local temporary-file handling rather than redirection of the token to an arbitrary remote endpoint. ### Attack Path 1. A local attacker creates `/tmp/gh_resp.json` as a symbolic link to a target writable by the victim account. 2. The victim invokes `github_issue.sh` in an environment where the REST API fallback is used. 3. The script submits the issue request to GitHub. 4. `curl` opens the predictable response path, follows the symbolic link, and truncates or overwrites the linked target. 5. The response is written into the target file. 6. A concurrent process may additionally replace or modify the r ...[truncated 661 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broader workflow skill for multilingual template maintenance across local files, Feishu Wiki, and GitHub. The actual code only performs one narrow subtask: syncing a specified local Markdown file to Feishu Wiki. While this partially overlaps with the declared Feishu sync function, it does not add translations, update multilingual template content, or create GitHub issues, and therefore does not accurately represent the full declared behavior. There is no clear undeclared malicious behavior, but there is a material description-versus-behavior mismatch because the implementation is substantially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

#   bash github_issue.sh --repo <owner/repo> --title <title> --body "inline body"
#
# Environment:
#   GITHUB_TOKEN — Personal access token with repo scope
#   (or use `gh auth login` if gh CLI is available)

usage() {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu_wiki_sync.sh (reported line 40)May include surrounding context.

sh

#   bash github_issue.sh --repo <owner/repo> --title <title> --body "inline body"
#
# Environment:
#   GITHUB_TOKEN — Personal access token with repo scope
#   (or use `gh auth login` if gh CLI is available)

usage() {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu_wiki_sync.sh (reported line 47)May include surrounding context.

sh

#   bash github_issue.sh --repo <owner/repo> --title <title> --body "inline body"
#
# Environment:
#   GITHUB_TOKEN — Personal access token with repo scope
#   (or use `gh auth login` if gh CLI is available)

usage() {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/github_issue.sh (reported line 11)May include surrounding context.

sh

#   bash github_issue.sh --repo <owner/repo> --title <title> --body "inline body"
#
# Environment:
#   GITHUB_TOKEN — Personal access token with repo scope
#   (or use `gh auth login` if gh CLI is available)

usage() {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run shell commands that can modify local files, call external scripts, interact with GitHub, and sync data to Feishu, but it declares no explicit tool restrictions or permission scope. In an agent environment, missing scope boundaries increases the chance of over-broad execution, unauthorized external actions, or data being sent to third-party services without clear control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly relies on credentials and directs synchronization of template content to Feishu and GitHub, but it does not warn that local content may be transmitted to external services. In a customer-service knowledge-base context, templates may contain internal wording, process details, or sensitive operational content, so silent exfiltration risk is materially higher.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_wiki_sync.sh (reported line 41)May include surrounding context.

sh

: "${FEISHU_APP_SECRET:?Set FEISHU_APP_SECRET}"

# 1. Obtain tenant access token
TOKEN=$(curl -s -X POST "${FEISHU_BASE_URL}/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}" \
  | jq -r '.tenant_access_token')

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_wiki_sync.sh (reported line 62)May include surrounding context.

sh

--arg content "$CONTENT" \
  '{title: $title, content: $content}')

HTTP_CODE=$(curl -s -o /tmp/feishu_resp.json -w "%{http_code}" \
  -X POST "${FEISHU_BASE_URL}/wiki/v2/spaces/${SPACE_ID}/nodes/${NODE_TOKEN}/docs" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/github_issue.sh (reported line 55)May include surrounding context.

sh

PAYLOAD=$(jq -n --arg title "$TITLE" --arg body "$BODY" '{title: $title, body: $body}')

HTTP_CODE=$(curl -s -o /tmp/gh_resp.json -w "%{http_code}" \
  -X POST "https://api.github.com/repos/${REPO}/issues" \
  -H "Authorization: token ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github.v3+json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/github_issue.sh (reported line 56)May include surrounding context.

sh

PAYLOAD=$(jq -n --arg title "$TITLE" --arg body "$BODY" '{title: $title, body: $body}')

HTTP_CODE=$(curl -s -o /tmp/gh_resp.json -w "%{http_code}" \
  -X POST "https://api.github.com/repos/${REPO}/issues" \
  -H "Authorization: token ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github.v3+json" \
  -d "$PAYLOAD")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction hard-codes formal register requirements for French and Korean as a mandatory behavior. This is a natural-language locale/style policy constraint that does not offer the user an option to choose a different register or explain that the constraint is user- or region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.