飞书文档写入（免费版）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

This skill is a Feishu document automation helper, but it gives broad document write, update, delete, query, export, credential, and command-execution authority without enough scoping or safety controls.

Review this skill before installing. Only use it with Feishu credentials that have the minimum required document permissions, confirm every write/update/delete action explicitly, and do not run the provided subprocess example unless the referenced index.js implementation is present, reviewed, and invoked by a trusted absolute path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:142

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:142
Vulnerability Type: Insecure dependency management
Risk Level: Medium

Vulnerable Code

bash

pip install requests

Technical Analysis

The setup instructions install requests without a version constraint, lockfile, or package hash. Consequently, the code installed by this command may change independently of the reviewed skill artifact. The instructions also do not require an isolated virtual environment or a specifically trusted package index.

This creates a supply-chain risk: compromise of the selected package release, its dependencies, or the configured package index could result in unreviewed code being installed. Package installation hooks, and subsequently imported package code, execute with the privileges of the user or agent running the setup.

Attack Path

1. An attacker compromises a package release, a transitive dependency, or the package source used by the victim's Python configuration.
2. The user or agent follows the documented setup instructions and runs pip install requests.
3. pip resolves and downloads the currently available, unpinned dependency set.
4. Malicious installation logic or package code executes with the invoking user's privileges.
5. The attacker can act within the permissions and environment available to that user or agent.

Impact Assessment

Successful exploitation could execute arbitrary package code with the privileges of the user performing the installation or running the resulting environment. Depending on those privileges, the affected scope may include accessible files, environment variables, API credentials, network resources, and agent workspaces. The document alone does not establish elevated or administrative execution, so privilege escalation beyond the invoking account is not claimed.

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed version rather than installing an unconstrained latest release.
• Maintain a lockfile containing exact direct and transitive dependency versions.
• Require hashes for downloaded distributions, such as through pip install --require-hashes.
• Install dependencies in a dedicated virtual environment with minimal privileges.
• Explicitly configure and document a trusted package index.
• Perform dependency vulnerability and provenance checks before publishing updates.
• Avoid performing dependency installation automatically during normal skill execution.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:152

Finding

Execution of an Unverified Relative-Path JavaScript File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:152-158
Vulnerability Type: Untrusted relative-path code execution
Risk Level: High

Vulnerable Code

python

result = subprocess.run([
    "node", "index.js",
    "--action", "append",
    "--token", doc_token,
    "--content", content
], capture_output=True, text=True)
return result.stdout

Technical Analysis

The example launches index.js using a path relative to the process's current working directory. The audited project contains only SKILL.md; it does not contain the referenced JavaScript implementation. Therefore, the example either fails because the file is missing or executes an unrelated index.js found in the working directory.

If an attacker can place or replace index.js in the directory from which this code runs, Node.js will execute that file without validating its origin, canonical path, or integrity. The use of an argument array rather than a shell command mitigates shell metacharacter injection through doc_token and content, but it does not prevent substitution of the JavaScript program itself.

Attack Path

1. An attacker obtains write access to the directory that will be used as the process's current working directory, or persuades the user or agent to run the example from an attacker-controlled project directory.
2. The attacker places a malicious file named index.js in that directory.
3. The user or agent invokes append_content.
4. subprocess.run starts Node.js and resolves index.js relative to the current working directory.
5. Node.js executes the attacker's JavaScript with the same operating-system privileges and environment as the invoking process.
6. The malicious script can access resources available to that account, including potentially exposed Feishu credentials or document tokens.

Impact Assessment

Successful exploitation provides arbitrary JavaScript execution under the invokin ...[truncated 363 chars]

Remediation

View remediation

Remediation Suggestions

• Package the reviewed JavaScript implementation with the skill rather than referencing an absent file.
• Resolve the script from a trusted skill installation directory, not from the current working directory.
• Construct and validate a canonical absolute path and reject paths outside the expected package directory.
• Verify the script against a trusted cryptographic hash or signed manifest before execution.
• Fail closed if the expected script is missing, modified, a symbolic link, or not a regular file.
• Use a restricted working directory and run Node.js with the minimum required operating-system and network privileges.
• Avoid exposing credentials unnecessarily through process arguments; use a protected credential channel where supported.
• Add explicit subprocess error handling, including checking the return code and handling timeouts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes document modification, possible deletion, credential usage, and command execution, yet provides no clear user-facing warnings or safety constraints around these sensitive actions. In combination with declared exec/write tools and environment-based secrets, this omission makes accidental destructive actions, credential misuse, and unsafe command execution more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a Feishu document writing/appending tool, but the body broadens behavior to creation, query, and export operations without clearly delimiting scope. This mismatch can cause an agent or user to invoke data-access actions they did not expect, increasing the chance of unintended data disclosure or unauthorized operations against Feishu content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation expands from write/append into modify and delete operations, which materially changes the risk profile of the skill. In an agent setting, ambiguous scope around destructive actions can lead to unintended document alteration or deletion, especially when paired with broad natural-language triggering and exec capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example invocation phrases are generic enough that ordinary user requests about documents could unintentionally activate this skill. Because the skill can write to external documents and references batch update/delete behaviors elsewhere, loose trigger phrases increase the risk of accidental modification of user data or cross-context tool activation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest tags include '支持创建' and '查询', while the top-level summary and description focus on writing/appending content to Feishu documents. This creates a semantic mismatch between the marketed capability set and the declared core purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.