T09 · Insecure Skill Coding Practices
Warning
- Location
- calendar-client.js:132
- Finding
- Sensitive calendar event data is written to process logs## Vulnerability Details **File Location**: `calendar-client.js:132-140` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Medium ### Vulnerable Code ```javascript result.events.forEach(event => { const start = new Date(parseInt(event.start_time.timestamp) * 1000); const end = new Date(parseInt(event.end_time.timestamp) * 1000); console.log(`\n📝 ${event.summary}`); console.log(` 时间: ${start.toLocaleTimeString()} - ${end.toLocaleTimeString()}`); if (event.description) console.log(` 描述: ${event.description}`); if (event.location?.name) console.log(` 地点: ${event.location.name}`); }); ``` ### Technical Analysis When the module is run directly, it prints event titles, times, descriptions, and locations to standard output. Calendar descriptions and locations may contain confidential meeting details, customer names, internal project information, physical locations, or links to restricted resources. Standard output is frequently captured by terminal history, CI systems, container runtimes, process supervisors, support bundles, and centralized log aggregation platforms. These systems may have broader access controls and longer retention periods than the Feishu calendar itself. The logging is not required for the core calendar API client functionality. The exported functions can return structured event data without disclosing it to an additional storage or monitoring channel. ### Attack Path 1. A user, CI job, or process supervisor runs `calendar-client.js`, directly or through the package test command. 2. The script authenticates using the configured Feishu application credentials. 3. It retrieves events from the selected calendar. 4. Event summaries, descriptions, times, and locations are written to standard output. 5. An operator or attacker with access to retained logs reads calendar information despite not necessarily having direct Feishu calendar access. ...[truncated 486 chars]
- Remediation
- ## Remediation Suggestions - Do not print event contents by default. Return structured results to the caller instead. - Place human-readable output behind an explicit command-line option such as `--show-events`. - Redact or omit sensitive fields, particularly descriptions and locations. - Document that verbose output may contain confidential calendar information. - Ensure production and CI logging systems apply appropriate access controls, encryption, retention limits, and deletion policies. - Where diagnostic logging is necessary, log only metadata such as the event count and request status.