T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:29- Finding
Unrestricted Cross-Agent Session Collection and External Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
飞书AI工作日报
Security checks for vulnerabilities and agentic risk
Overview
This skill openly generates and sends a Feishu daily report, but it does so by reading raw cross-agent session logs and reusing private DM text without clear consent, scoping, or review controls.
Review this skill carefully before installing. It should only be used in an environment where all affected agents and users have agreed that their same-day DM-derived work messages may be collected, stored in a plaintext report, and sent to the configured Feishu destination. Prefer adding explicit approval, redaction, fixed recipient allowlisting, and a narrower work-log source before use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These instructions define a workflow that collects user-originated content from session logs and repurposes it into a generated report. That is a direct data-leakage pattern because private user messages are harvested from stored conversations and transformed for secondary use without consent or clear need-to-know boundaries.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The extraction logic specifically tells the agent to parse DM records, strip identifiers, and reuse the actual user utterances as work records. This is especially dangerous because it operationalizes disclosure of verbatim private communications, increasing the chance of leaking secrets, personal data, or confidential business information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Sending the compiled report to Feishu extends the exposure from local processing to a separate communication channel, increasing the blast radius of any included sensitive content. Once transmitted, the data may be retained, forwarded, or accessed by unintended recipients, making recovery and containment much harder.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough that normal conversation like '生成日报' or '工作日报' may invoke the skill unintentionally. Because this skill reads session logs, saves a report, and sends content onward, accidental invocation can cause unauthorized processing and disclosure of user-derived data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly directs direct reading of session JSONL logs and extraction of user messages, but provides no privacy warning or access-control requirement. Reading historical conversations from other agents is highly sensitive and can expose confidential user content outside the original interaction context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to save a compiled report to disk and send it to Feishu without any notice, consent, or data-classification guardrails. This creates a real risk of silently exfiltrating sensitive internal or personal content derived from user sessions to persistent storage and an external messaging destination.
- Content
Static analysis
No suspicious patterns detected.