协作平台卡片基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

The skill is a Feishu/Lark-style card sender, but it relies on missing executable code and broad local permissions that are not adequately scoped or verifiable.

Review before installing. Use this only in a constrained environment, verify and pin the feishu-common dependency and sender scripts from a trusted source, avoid sending secrets or regulated data in card text or titles, confirm recipients and callback URLs before use, and prefer a version that bundles or integrity-verifies its executable code.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned and Unverifiable External Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-46
Vulnerability Type: Supply-chain risk from an unpinned external dependency
Risk Level: Medium

Evidence

The following is an English rendering of the complete relevant source segment:

markdown

## Prerequisites

- The `feishu-common` dependency must be installed first.
- This skill depends on `./feishu-common/index.js` for token and API authentication.

Additional execution instructions reference files that are not included in the project:

bash

node skills/feishu-card/send.js --target "ou_..." --text "Hello World"
node skills/feishu-card/send_safe.js

Technical Analysis

The project contains only SKILL.md. It does not include feishu-common/index.js, send.js, or send_safe.js, even though these components are expected to perform authentication, process untrusted message content, create temporary files, and communicate with an external service.

The documentation does not identify a trusted package source, pin an exact dependency version, provide an integrity hash, or define a signature-verification procedure. Consequently, the effective executable code is determined outside the audited project. The advertised token protection, temporary-file cleanup, shell escaping, input validation, and network behavior cannot be verified.

This creates a supply-chain trust boundary in which a malicious or incorrectly resolved feishu-common component—or a substituted script at one of the documented paths—could execute with the Agent process's permissions.

Attack Path

1. An attacker gains control over the source from which feishu-common is obtained, or places a malicious component at the expected ./feishu-common/index.js path.
2. Alternatively, the attacker places substituted send.js or send_safe.js files under the documented skills/feishu-card/ path.
3. A user or Agent follows SKILL.md and executes the referen ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the required implementation with the skill so that all executed code can be reviewed.
2. If an external dependency is necessary, document its official registry or repository and pin an exact immutable version or commit.
3. Verify the dependency with a cryptographic integrity hash or trusted signature before execution.
4. Reject missing, unexpected, symbolic-link redirected, or integrity-mismatched dependency paths.
5. Document and enforce the permitted Feishu API hosts so the dependency cannot silently redirect credentials.
6. Add automated dependency scanning and lockfile verification to the release process.
7. Audit the implementations of index.js, send.js, and send_safe.js, particularly their credential handling, command construction, temporary-file permissions, cleanup behavior, and network requests.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Overly Broad Agent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: Excessive execution and filesystem permissions
Risk Level: Medium

Evidence

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares general read, command-execution, and write capabilities. Its documented purpose is limited to constructing and sending a text card, but the configuration does not define filesystem boundaries, executable allowlists, working-directory restrictions, or network destination constraints.

Execution permission is required by the documented Node.js workflow, and limited temporary-file access may be necessary for send_safe.js. However, unrestricted read and write access exceed those narrowly defined needs. This is particularly significant because the code that would exercise these permissions is external to the audited project and cannot be inspected.

The declaration does not independently prove that unauthorized files are accessed. The security weakness is the absence of least-privilege controls around components that are expected to process credentials and execute locally.

Attack Path

1. An attacker compromises or substitutes one of the externally supplied components referenced by the skill.
2. The user or Agent invokes the skill and executes that component.
3. The malicious component operates through the broadly granted execution and filesystem capabilities.
4. It reads files accessible to the Agent, writes or modifies local data, or launches additional processes.
5. It may then use the skill's messaging or network context to disclose collected information or perform unauthorized actions.

Exploitation depends on malicious or compromised executable code being invoked; the audited SKILL.md does not contain such a payload itself.

Impact Assessment

The obtainable privileges are bounded by the operating-system account and sandbox in which the Age ...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove general read and write permissions unless they are demonstrably required.
2. Restrict filesystem access to a dedicated temporary directory created with owner-only permissions.
3. Allow execution only of bundled, integrity-verified scripts and the required Node.js runtime.
4. Prevent execution of arbitrary shell commands and avoid invoking a shell when direct process argument arrays are sufficient.
5. Apply an outbound network allowlist limited to documented official API endpoints.
6. Run the implementation under a dedicated low-privilege account or sandbox without access to unrelated user files and credentials.
7. Store authentication material in a scoped secret provider and expose only the specific credential required for message delivery.
8. Document each requested tool permission and enforce a fail-closed policy if the platform cannot provide the required restrictions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description claims broad applicability to Feishu-related development scenarios rather than narrowly scoping when the skill should be invoked. In an agent environment, this can cause over-activation and unintended use of exec-enabled messaging workflows, increasing the chance that user content or identifiers are sent externally without a clear, task-specific trigger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation explains message sending and includes an optional callback_url, but does not prominently warn that message text, titles, target IDs, and possibly callback data may be transmitted to external services. This creates a real risk of unintentional data exfiltration, especially in agent workflows where users may assume operations are local unless outbound transfer is disclosed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.