T09 · Insecure Skill Coding Practices
Error
- Location
references/oauth-setup.md:41- Finding
Hard-Coded Feishu Application Secret
- Content
View full analysis
- Remediation
View remediation
Security audit
飞书日历管理（中文版）
Security checks for vulnerabilities and agentic risk
Overview
This Feishu calendar skill is mostly purpose-aligned, but it exposes and stores sensitive OAuth credentials and under-discloses write-capable calendar access.
Review before installing. This skill can access Feishu calendar data and create events, and its documentation exposes an app secret and stores user OAuth tokens in plaintext under the skill directory. Install only if the app secret has been rotated or replaced, token storage is protected, write permissions are intentional, and calendar writes require clear user confirmation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/oauth-setup.md:65- Finding
OAuth Access and Refresh Tokens Stored Without Explicit Access Restrictions
- Content
View full analysis
"}' exit 1 fi # 读取 user_access_token USER_TOKEN=$(cat "$TOKEN_FILE" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4) if [ -z "$USER_TOKEN" ]; then echo '{"error": "无效的用户 token，请重新授权"}' exit 1 fi ``` ### Technical Analysis The OAuth access token and longer-lived refresh token are written as plaintext JSON. The setup procedure neither applies an owner-only permission mode nor checks whether an existing file or parent directory has permissive access controls. OAuth bearer tokens are usable by whoever possesses them. An access token can be replayed directly, while a refresh token can be exchanged for replacement access tokens and may extend unauthorized access beyond the original access token's lifetime. This issue depends on local file access. The audit did not establish that the file is universally readable on every supported platform; the weakness is the absence of explicit protection and validation for highly sensitive stored credentials. ### Attack Path 1. A legitimate user completes the OAuth setup procedure. 2. The procedure writes `.user_token.json` containing the access token and refresh token. 3. Another local user, comp ...[truncated 766 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create_event.sh:60- Finding
JSON Injection Through Unescaped Event Fields
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/oauth-setup.md:31- Finding
OAuth Flow Uses a Fixed State Parameter
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation says the required permission is read-only, but the skill instructions perform privileged actions: creating calendar events and updating the token file with refreshed credentials. This mismatch can cause operators and users to approve the skill under a false assumption, leading to unintended data modification both remotely and locally.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a true security issue because the document exposes a specific app secret and normalizes insecure credential handling without any warning. In the context of an OAuth setup guide, readers are likely to copy the pattern directly, increasing the chance of credential leakage and unauthorized application access.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs users to save highly sensitive access and refresh tokens to disk without any warning or safeguards. In a calendar-management skill, those tokens can expose private meeting contents, attendee metadata, and enable unauthorized event creation or modification, making the context especially sensitive rather than less dangerous.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill includes shell/PowerShell procedures that read local token files, write refreshed credentials, and invoke remote APIs, but it declares no tool scope or permission boundaries. In an agent setting, missing explicit allowed-tools/permissions increases the chance that the skill can be invoked with broader-than-expected execution capability or without adequate user awareness.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad enough to overlap with normal conversation about schedules or meetings, which can lead to accidental invocation of a skill that reads credentials, contacts external services, and may create events. In this context, over-broad activation is more dangerous because the skill includes mutating operations and access to sensitive tokens.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents reading a local token file, using bearer tokens, and later writing refreshed credentials back to disk, yet it does not prominently warn about sensitive credential handling or local file modification. This lack of disclosure raises the risk of unsafe reuse, accidental exposure of secrets, or execution in environments where writing plaintext tokens is unacceptable.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Claiming read-only access while instructing users to create events is a permission-transparency failure. Even if the API calls are legitimate, the mismatch undermines informed consent and can result in the skill being deployed in contexts where only non-mutating access was expected.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide includes a concrete plaintext app secret directly in the example PowerShell, which exposes a real credential to anyone who can read the repository or rendered documentation. In an OAuth/calendar skill, that secret can be abused to impersonate the application, obtain app tokens, and assist further token exchange or API abuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions tell users to write the user access token and refresh token to an unencrypted JSON file inside the skill workspace. Because these tokens grant access to a user's personal calendar, local compromise, workspace syncing, backups, or accidental commits could expose sensitive schedule data and allow unauthorized API actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This shell script reads FEISHU_APP_ID and FEISHU_APP_SECRET from environment variables and posts them to a remote API, which is a sensitive operation under the code-file warning criteria. Although there are internal comments in Chinese, there is no visible user-facing confirmation, prompt, or runtime disclosure before transmitting the credentials.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # 获取 tenant_access_token RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # 创建事件 RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/calendar/v4/calendars/$CALENDAR_ID/events" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The request payload forces all created calendar events to use the "Asia/Shanghai" timezone in natural-language/configuration content embedded in the code. This is a locale policy concern because users are not given any opt-in or parameter to select another timezone, and the file does not justify that the skill is limited to a Shanghai-specific context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh TIME_MAX="${END_DATE}T23:59:59+08:00" # 查询忙闲状态 RESPONSE=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/calendar/v4/freebusy/list" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This shell script sends a POST request to an external Feishu API using a bearer token obtained from another script. While the comments indicate the script queries calendar free/busy data, there is no user-facing prompt, warning, or runtime disclosure that calendar data will be transmitted over the network with authenticated credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This shell script makes HTTP requests to Feishu APIs using a stored user access token and transmits calendar query parameters, but the only comments are developer-oriented and there is no explicit user-facing warning, prompt, or disclosure about contacting the remote service. For code files, network calls that transmit user or system data should have some visible disclosure unless already clearly warned elsewhere.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
文件整体描述和示例均固定为中文，未说明该技能是否仅面向中文用户，也没有提供语言/locale 选择。若组织要求技能不应默认强制特定语言而无用户选择，这种单一语言设定可能构成自然语言政策问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
SQP-3 covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all instructions exclusively in Chinese and does not mention that the skill or documentation is language-specific or offer an alternative.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script's human-readable comments and error messages are entirely in Chinese, including the only user-visible runtime messages. Under the policy criteria, this is a locale/language constraint presented without user opt-in or justification that the skill is intentionally Chinese-only.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script's comments and user-visible error/output strings are written in Chinese, and there is no indication that this locale is optional or intentionally restricted to a Chinese-speaking environment. This can violate language/locale policy when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Comments and emitted error strings are written only in Chinese, which can force a specific language experience on users without opt-in. The policy allows locale constraints when explicitly offered as a choice or clearly justified as region-specific, which is not stated here.
- Content
Static analysis
No suspicious patterns detected.