Security audit

飞书文档

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a Feishu document helper, but it asks for broad file, write, and command-execution authority with unclear boundaries.

Review this skill carefully before installing. Use it only for explicit Feishu/Lark document-writing tasks, avoid giving it sensitive local files unless needed, and confirm any API key, document write, image upload, or command execution before allowing the agent to proceed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as a Feishu document-writing and Markdown-to-Block conversion tool, but it also advertises unrelated bulk messaging and callback capabilities. This kind of scope expansion increases the chance that an agent invokes the skill for actions beyond the user's expectations, creating authority creep and potentially causing unintended external-side effects.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The description broadens the skill from Feishu document conversion into generic file handling, format conversion, and content extraction. Overbroad claims can cause an agent to route unrelated tasks to a skill that also has write and exec capabilities, increasing the risk of misuse and accidental data exposure or modification.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill declares exec capability even though the documented business purpose is Markdown-to-Feishu document writing. Unnecessary command execution materially raises risk because an agent may use shell access to process attacker-controlled content, local files, or environment variables, enabling command injection, secret access, or host abuse if coupled with permissive prompts or wrappers.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: Later sections explicitly describe command execution as a built-in feature, conflicting with the stated core function of Feishu document writing. This inconsistency is dangerous because it normalizes broader privileged behavior than users would infer from the skill name, making abuse or mistaken invocation more likely.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation language is so broad that the skill may be selected for generic file handling or content extraction tasks unrelated to Feishu document writing. In context, that is risky because the skill advertises write and exec tools, so loose routing can expose data or trigger unintended modifications in local or external systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description does not clearly disclose that the skill may write content to Feishu documents or upload media to external APIs. Users and routing agents therefore may not recognize that invocation can transmit data off-host, which creates consent, privacy, and data-handling risks.

Static analysis

No suspicious patterns detected.