ClawHub
Back to skill

Security audit

飞书文档管理器Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Feishu document manager, but it asks for broad Feishu authority and gives direct examples for clearing document content without confirmation guardrails.

Review before installing. Grant only the Feishu scopes needed for the operations you actually want, avoid docs:permission.member unless collaborator management is required, and require explicit confirmation before any delete or clear-document action. Treat the weather example as unsafe sample code unless rewritten to serialize JSON safely and bound external content.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:19
Finding

Unnecessary Collaborator-Management Permission Violates Least Privilege

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:186
Finding

Untrusted Weather Data Is Concatenated Directly into a JSON Request

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The documented delete endpoint can remove arbitrary document content based on index ranges, and the surrounding examples normalize deleting all child blocks with broad parameters. In a tool-using agent, this creates a parameter-abuse risk: if document_id, block_id, or deletion ranges are derived from ambiguous or manipulated input, the agent could wipe the wrong document or far more content than intended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

text

**API 说明：**
- **URL**: `DELETE /documents/:document_id/blocks/:block_id/children/batch_delete`
- **参数**: `start_index`（起始索引）、`end_index`（结束索引，左闭右开）
- **注意**: `start_index` 必须小于 `end_index`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents bulk deletion and document-clearing operations but does not require an explicit confirmation step or prominent warning about irreversible data loss. In an agent setting, this increases the chance that a user request is interpreted too broadly and valuable document content is destroyed without sufficient friction or review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

技能清单将该技能限定为对飞书文档进行创建、读取、写入、删除和清空操作，但完整示例中额外调用 wttr.in 获取天气数据。获取第三方外部内容并非文档管理本身的直接必要能力，而是引入了与技能目的无关的外部数据访问能力。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.