T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
references/quick-reference.md:173- Finding
Overly Broad Tool-Profile Escalation in Permission Troubleshooting
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Writing Bundle
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Feishu document-writing guide, but it gives broad document mutation and permission-expansion guidance that users should review carefully.
Install only if you intend agents to create and edit Feishu documents on your behalf. Confirm the exact target document or workspace before writes, be especially careful with delete_range, replace_all, and overwrite, and do not enable an unrestricted full tool profile just to fix a Feishu permission error.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents a skill whose core behavior is to create and update user documents, including operations like replacing content and delivering a doc link. While line L070 marks overwrite as '慎用', the overall skill description does not provide a clear user-facing warning that the skill can modify or remove existing document content and should be used with care around user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The markdown enumerates update modes including
delete_range, which can remove document content irreversibly, but provides no accompanying caution or disclosure for that destructive behavior. Under the markdown-file criteria, user warnings should be present when described behavior may affect user data or system integrity.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs the agent to create or update Feishu documents and return links, but it does not require explicit user confirmation before making user-visible external changes. In an agent setting, this can cause unintended publication, modification of shared documents, or writes into the wrong workspace/document when the user's intent is ambiguous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section recommends replacement and deletion operations on existing Feishu documents without an explicit destructive-action warning or confirmation step. Because these actions can remove or overwrite collaborative content, an agent following this guidance could irreversibly damage important shared documents or alter records beyond the user's intended scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The package description is written entirely in Chinese and presents the skill as a Chinese/Feishu writing bundle without any indication that users may choose another language or locale. This can violate language-choice policy because it implicitly constrains usage to a specific language context without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document title and core applicability statements are entirely in Chinese and present the guidance as the default operating procedure for the agent. There is no indication that language should follow user preference or that other languages are supported, which can violate a language/locale policy requiring user choice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guidance instructs the agent to read a local file path under /tmp after downloading a chat attachment, which expands the skill from document writing into local file access. Even though the example path is tied to a prior Feishu download, normalizing direct read() calls on local paths increases the chance an agent will read unintended local files if inputs are manipulated or if the pattern is copied elsewhere without validation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire reference content is written in Chinese and presents operational rules without indicating that language choice is optional or user-driven. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The rule states that when users ask broadly to 'write a document' or 'organize into a document,' the default output should be creating/updating a Feishu doc and returning a link. That creates an overly broad activation boundary: common drafting requests that could reasonably expect an in-chat response may instead trigger external side effects, including document creation in a user workspace. In a multi-tool agent, this increases the risk of surprising actions, privacy issues, and unintended writes to third-party systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The invocation guide uses very broad, natural-language triggers like '写个飞书文档' and '整理成文档', which are common user phrases and may cause the skill to activate in situations where the user did not intend document creation or modification. In a skill that can create and update Feishu documents, overbroad routing increases the chance of unintended writes, especially when combined with the guidance to default to direct tool execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The quick reference includes destructive modes such as 'overwrite', 'replace_range', 'replace_all', and 'delete_range', but does not require explicit user confirmation, backup creation, or a prominent safety warning before modifying content. Although 'overwrite' is labeled '慎用', the guidance still operationalizes destructive edits and even encourages immediate fallback actions after failures, which can amplify the risk of accidental data loss in user documents.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill-facing document is written in Chinese and provides instructions only in that language, with no indication that users can choose another language or that the locale restriction is intentional and documented. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file presents all operational instructions, triggers, and output requirements exclusively in Chinese. Under the policy rule for language/locale, forcing a single language without user opt-in or documented justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents its operative guidance entirely in Chinese, which can amount to a language policy constraint if users are expected to follow it without an explicit opt-in or documented scope. The file does not indicate that the skill is region-specific or that Chinese is an intentional, justified requirement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation description uses a broad natural-language example like “检索资料并写个飞书文档” without defining scope, constraints, or exclusions. This could cause unintended activation for ordinary requests involving research and document writing, especially since no negative examples or narrower trigger boundaries are provided.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The examples “改这篇飞书文档” and especially “改这篇演讲稿” are generic editing requests that could match many normal conversations. The file does not clarify when this workflow applies versus other editing workflows, nor does it provide exclusions or required context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Phrases like “改成能发的 proposal” and “要正式一点” are subjective and broad, with no clear threshold for what qualifies for this workflow. Without constraints or exclusions, common requests to polish tone may unintentionally trigger proposal-generation behavior.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The best-practices document broadens the workflow to include searching chat history and downloading files, capabilities not clearly reflected in the skill's stated document-writing purpose. This can lead to over-collection of user data and unnecessary access to messages or attachments when a narrower workflow would suffice.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The guidance includes reading Feishu Bitable records, which extends the skill into structured data extraction beyond straightforward document authoring. In a writing-oriented skill, this creates unnecessary data-access breadth and may expose unrelated records if the agent is given broad table access.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The workflow instructions are entirely in Chinese and do not indicate that language selection is optional or limited to a justified region-specific context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.