飞书文档工具（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.2

Overview

This Feishu document skill is not clearly malicious, but it asks agents to run an unbundled relative script and perform broad document-changing actions without enough scoping or confirmation.

Review carefully before installing. Use only in a restricted workspace, do not run the documented node index.js command unless you have a trusted implementation path, grant Feishu credentials with least privilege, and require explicit confirmation before creating, modifying, appending, or deleting documents.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:145

Finding

Execution of an Unbundled Relative Node.js Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:145-161
Vulnerability Type: Untrusted relative-path executable resolution
Risk Level: High

Vulnerable Code

python

# Feishu document operations
import subprocess
# ...
# Read document
result = subprocess.run([
    "node", "index.js",
    "--action", "read",
    "--token", "doccnXXXXXXXX"
], capture_output=True, text=True)
print(result.stdout)
# ...
# Create document
result = subprocess.run([
    "node", "index.js",
    "--action", "create",
    "--title", "Meeting Minutes"
], capture_output=True, text=True)
print(f"Document token: {result.stdout.strip()}")

Technical Analysis

The documented operations launch index.js using a path relative to the process's current working directory. The audited project contains only SKILL.md; it does not include the referenced index.js implementation.

Consequently, these examples either fail because the script is missing or execute whichever file named index.js happens to exist in the working directory. An attacker who can place or replace that file can cause legitimate-looking Feishu operations to run attacker-controlled JavaScript through Node.js. Using an argument array prevents shell metacharacter injection, but it does not prevent the relative-path substitution issue.

Attack Path

1. An attacker gains the ability to place a file in the directory from which the Agent or user will execute the documented command. This may be a shared workspace, extracted archive, cloned repository, or attacker-supplied project.
2. The attacker creates a malicious file named index.js.
3. The user or Agent follows the Skill's documented read or create workflow.
4. subprocess.run() launches node index.js without resolving the script against a trusted Skill directory.
5. Node.js executes the attacker's script with the privileges and environment of the Agent process.

Impact Asses

...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the required implementation in the package and place it in a fixed, documented location.
2. Resolve the script path relative to the trusted Skill installation directory rather than the current working directory:

   python

   from pathlib import Path
   import subprocess
   
   skill_dir = Path(__file__).resolve().parent
   script = (skill_dir / "index.js").resolve()
   
   if not script.is_file() or script.parent != skill_dir:
       raise RuntimeError("Trusted index.js implementation is missing")
   
   result = subprocess.run(
       ["node", str(script), "--action", "read", "--token", token],
       capture_output=True,
       text=True,
       check=True,
       cwd=str(skill_dir),
       timeout=60,
   )
   

3. Verify the packaged script's integrity using signed release artifacts or a trusted manifest containing cryptographic hashes.
4. Do not search the current directory or other writable locations for missing executable components.
5. Run the implementation with least privilege, a restricted environment, an explicit executable path, and network/file-system sandboxing where available.
6. Fail closed when the expected script is missing or fails integrity validation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:135

Finding

Unpinned Runtime Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:135-138
Vulnerability Type: Unpinned and unverifiable dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Ensure the Python environment is available
python3 --version
# ...
# Dependency instructions
pip install requests

The same unpinned installation instruction is repeated in the dependency table at SKILL.md:230.

Technical Analysis

The Skill instructs users to install requests without a version constraint, lock file, package hash, or explicitly trusted package index. The effective dependency can therefore change between installations, making deployments non-reproducible and allowing an unaudited future version to enter the execution environment.

The package name is legitimate and the audit found no evidence of dependency confusion or an intentionally malicious package. Nevertheless, installing an unconstrained package at runtime exposes the environment to upstream compromise, unexpected breaking changes, compromised package-index responses, or unsafe index configuration inherited from the user's environment.

Attack Path

1. The user or Agent follows the environment-preparation instructions.
2. pip resolves requests using the environment's configured package indexes and selects the latest compatible release at that time.
3. If the selected distribution or configured source has been compromised, or if an unreviewed release contains exploitable behavior, it is downloaded without hash verification.
4. The dependency is installed into the selected Python environment.
5. Package installation or subsequent import and use exposes the Agent process to the compromised component.

Impact Assessment

A compromised dependency may execute code during installation or when imported by a consuming implementation. Such code would inherit the Python process's permissions and could access files, credentials, environment va ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

1. Determine whether requests is actually required. Remove the installation instruction if no bundled implementation uses it.
2. Pin an audited version in a requirements file rather than resolving an arbitrary future release:

   text

   requests==<reviewed-version>
   

3. Generate and retain cryptographic hashes for all direct and transitive dependencies, then require hash verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use a lock file generated from a reviewed dependency set and update it through a controlled dependency-review process.
5. Specify an approved HTTPS package index and prevent fallback to untrusted or user-controlled extra indexes.
6. Install dependencies in an isolated virtual environment with least privilege rather than into the system Python environment.
7. Scan pinned dependencies for known vulnerabilities and review dependency changes before publishing a new Skill release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises remote state-changing capabilities including create, write, append, block operations, and even delete-mode language, but it provides no clear warning, consent flow, or confirmation step for destructive or persistent actions. In the context of a document-integration skill connected to Feishu, this raises the risk of unintended data creation, corruption, overwrite, or deletion in user workspaces if the agent misinterprets prompts or is prompt-injected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documentation repeatedly presents this as a free personal-use Feishu document tool focused on reading, creating, writing, appending, and block operations. However, L089 explicitly says the core capability supports '创建/查询/修改/删除' modes, which contradicts the earlier capability descriptions and materially expands the stated intent to include deletion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrases are very broad, natural-language prompts such as reading or creating documents, with little scoping or confirmation guidance. In an agent environment, this can cause accidental invocation during ordinary conversation and unintended access to or modification of Feishu documents, especially because the skill also advertises exec-backed actions and remote document operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.