飞书文档

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.1

Overview

The skill mostly describes fetching Feishu documents, but it asks for broad agent powers and gives overbroad permission guidance that users should review before installing.

Install only if you intend the agent to access Feishu content and can restrict it to a dedicated read-only Feishu application. Prefer per-document or specific knowledge-base access, avoid granting all cloud-document permissions, do not run the agent as administrator, and avoid enabling write or exec authority unless a separate reviewed workflow explicitly requires it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:317

Finding

Overbroad Feishu Document Permissions Recommended for Read-Only Retrieval

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 317
Vulnerability Type: Excessive application permissions
Risk Level: High

Relevant source excerpt, translated into English:

markdown

A: Confirm that the application has been added as a document collaborator, or enable "all cloud-document permissions" for the application. For knowledge-base documents, add the application as a knowledge-base member and grant read permission. If another department created the document, contact the document owner for authorization.

Technical Analysis

The Skill is designed to retrieve user-selected Feishu documents, spreadsheets, and knowledge-base entries. Document-level or knowledge-base-level read permission is sufficient for this declared functionality. Recommending that users enable all cloud-document permissions expands the application's authorization beyond the minimum required scope.

This is a least-privilege violation. If the Agent, its credentials, or any tool operating within the same authorization context is compromised or misused, the unnecessarily broad authorization could permit access to documents unrelated to the user's requested operation. The package contains no implementation demonstrating that tenant-wide access is technically required.

Attack Path

1. A user attempts to retrieve a Feishu document and receives a permission error.
2. The user follows the Skill's troubleshooting guidance and grants the application all cloud-document permissions.
3. The application credential consequently gains access to a broader collection of organizational documents than the requested item.
4. A compromised Agent session, exposed credential, malicious prompt, or misused API client submits requests for unrelated documents.
5. Feishu authorizes those requests because of the excessive permission grant.
6. Unrelated document, spreadsheet, Bitable, or knowledge-base content may be retrieved and exposed.

...[truncated 569 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to enable all cloud-document permissions.
2. Document the exact Feishu read-only scopes required for Wiki, Docx, Sheets, and Bitable operations.
3. Prefer per-document collaboration grants or narrowly scoped knowledge-base membership.
4. Separate optional bulk-export permissions from ordinary single-document retrieval permissions.
5. Require explicit user confirmation before any operation traverses an entire knowledge space.
6. Use dedicated credentials with read-only access and avoid sharing credentials across unrelated workflows.
7. Provide a permission-denied error that identifies the missing resource-specific scope rather than recommending blanket authorization.
8. Audit API activity and redact access tokens, document tokens, and sensitive content from logs.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:407

Finding

Administrator Execution Recommended as Generic Permission Troubleshooting

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 407
Vulnerability Type: Unnecessary host privilege elevation
Risk Level: Medium

Relevant source excerpt, translated into English:

markdown

| Insufficient permissions | The current user lacks read or write permission | Check file permissions and run as administrator |

Technical Analysis

The troubleshooting table recommends administrator execution when local file access fails. The Skill's declared functionality consists primarily of HTTP retrieval and output formatting, neither of which generally requires administrator privileges.

Running an AI Agent with administrator privileges causes its declared read, write, and exec tools to inherit elevated host permissions. This substantially increases the consequences of malformed input, prompt injection from retrieved document content, unsafe command construction, or unrelated defects. The guidance does not first require validation of the target path, correction of ownership, use of a user-controlled output directory, or narrowly scoped permission changes.

Attack Path

1. A file read or write operation fails because the selected path is protected or incorrectly configured.
2. The user follows the troubleshooting guidance and restarts the Agent with administrator privileges.
3. The Agent's file and command-execution tools inherit elevated operating-system access.
4. A malicious instruction in retrieved content, an unsafe generated command, or a compromised workflow induces an unintended file or command operation.
5. The operation executes with administrator privileges rather than ordinary user permissions.
6. Host files, system configuration, or other users' data may be modified or disclosed within the administrator account's authority.

Impact Assessment

Successful exploitation could expand access from ordinary user resources to protected system files, application configuration, cre ...[truncated 402 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic recommendation to run the Agent as administrator.
2. Direct output to a dedicated user-owned directory with restrictive permissions.
3. Diagnose path, ownership, and access-control problems before proposing any privilege change.
4. If a privileged operation is genuinely necessary, isolate that single operation in a reviewed helper rather than elevating the entire Agent.
5. Remove the exec tool declaration unless a concrete, constrained command-execution requirement exists.
6. Apply command allowlisting, argument separation, timeouts, and sandboxing to any retained execution capability.
7. Explicitly warn users not to run the Skill or hosting Agent as root or administrator.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a Feishu document fetcher, but the documentation introduces unrelated capabilities such as message sending, variable injection, callback handling, archival/retrieval, file writing, and command execution. This scope expansion increases the chance that an agent will invoke broader privileges than the user expects, enabling data exfiltration, unauthorized outbound actions, or persistence workflows using fetched document content.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explains how to fetch and export Feishu wiki, doc, sheet, and bitable data but does not prominently warn that these sources may contain sensitive corporate information. In an agent environment, that omission makes accidental over-collection, cross-document export, or disclosure to downstream tools more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Command execution is not justified by the core function of reading Feishu docs and materially raises the risk profile of the skill. If an agent can execute commands while processing untrusted document URLs or content, the skill could become a pivot for local system access, tool abuse, or covert exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is overly broad, encouraging use for general writing and marketing tasks rather than narrowly for Feishu document retrieval. Broad triggers increase the likelihood that the skill is invoked in contexts where it can unnecessarily access external documents and sensitive workspace content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This section advertises file handling and command execution as normal features even though the skill's stated purpose is fetching Feishu content. Normalizing these extra behaviors can cause an agent to write sensitive document data to disk or execute local commands in workflows where users only intended read-only retrieval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document mixes a content-fetching skill with generic command-execution workflows, making dangerous operations appear routine. That ambiguity can mislead agents and users into approving or triggering local execution steps unrelated to Feishu retrieval, especially in automated pipelines.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.