飞书连接问题解决方案

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:56 AM UTC
• Version: 1.0.1

Overview

The skill is a documentation-only Feishu troubleshooting guide, but it tells users to grant broad chat, calendar, task-writing, and employee-ID permissions without enough scoping or warnings.

Review the listed Feishu scopes before importing them. Only grant message, calendar, task, and employee-ID permissions that your integration actually needs, prefer read-only scopes where possible, and revoke unused task-writing or employee-directory access from already published apps.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:63

Finding

Calendar setup requests unrelated task and employee-directory privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-77 and duplicated verbatim in README.md:63-77
Vulnerability Type: Excessive permission request and least-privilege violation
Risk Level: Medium

Vulnerable configuration:

json

{
  "scopes": {
    "tenant": [
      "calendar:calendar",
      "calendar:calendar:readonly",
      "task:task:write",
      "task:task:read",
      "contact:user.employee_id:readonly"
    ],
    "user": [
      "calendar:calendar",
      "calendar:calendar:readonly",
      "task:task:write",
      "task:task:read"
    ]
  }
}

Technical Analysis

The section is presented as a procedure for enabling calendar permissions, but its recommended configuration also requests tenant-level and user-level task read/write privileges. It additionally requests tenant-level access to employee identifiers.

These capabilities are not justified by the documented calendar troubleshooting objective. In particular, task:task:write permits modification rather than merely observation, while task:task:read and contact:user.employee_id:readonly expand access into task and employee-directory data. The simultaneous inclusion of full calendar access and read-only calendar access also indicates that the permission set has not been minimized according to the actual operation required.

The artifact contains documentation rather than executable application code, so it does not itself exercise these permissions. The risk arises when a user follows the instructions, imports the supplied scope configuration, approves it, and connects an application capable of using the granted Feishu authorization.

Attack Path

1. An administrator follows the calendar permission instructions in SKILL.md or README.md.
2. The administrator imports the supplied JSON into the Feishu application permission manager.
3. The application is approved and published with task read/write and ...[truncated 1203 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove task:task:write, task:task:read, and contact:user.employee_id:readonly from the calendar permission example unless a documented feature explicitly requires each scope.
2. Use only calendar:calendar:readonly when the integration merely reads calendar information.
3. Request calendar:calendar only when the application must create, update, or delete calendar resources.
4. Separate calendar, task, and contact capabilities into independent, opt-in permission examples so administrators do not grant unrelated privileges as one bundle.
5. Document the exact operation enabled by every requested scope, whether it is tenant-level or user-level, and why a narrower scope is insufficient.
6. Add a warning that administrators should review requested scopes before approval and should not grant optional write privileges by default.
7. Apply the same corrections to README.md, which duplicates the affected configuration.
8. Review already deployed applications and revoke unnecessary task, contact, or write-capable calendar scopes. Rotate application credentials if there is evidence that an overprivileged integration was compromised.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document content is entirely in Chinese, and it does not indicate that the skill is intended only for a Chinese-speaking audience or provide an opt-in language choice. Under the policy criteria, forcing a specific language without user choice or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to grant a broad set of messaging and user-data permissions, including message read/send and employee ID access, without explaining the sensitivity of those scopes or applying least-privilege guidance. This can lead administrators to overprovision the bot, increasing exposure of private chats, metadata, and account abuse potential if the bot or its backend is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The calendar and task permission block asks for access to potentially sensitive schedule and task data but provides no warning about confidentiality, business sensitivity, or least-privilege considerations. Users may grant broad tenant and user scopes without understanding that the application could read or modify calendars and tasks across accounts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is written entirely in Chinese and does not indicate that language selection is optional or that the skill is intended only for Chinese-speaking users. Under the stated policy, this is a natural-language locale constraint without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.