T01 · Skill Instruction Hijacking
Error
- Location
prompts/persona_builder.md:18- Finding
Generated Skills Assign Unconditional Priority to Persona Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
colleague-skill
Security checks for vulnerabilities and agentic risk
Overview
This skill is broadly about building a colleague-like AI profile, but it can collect private workplace messages, reuse browser sessions, store credentials and raw data locally, and generate persistent persona instructions with weak safeguards.
Install only if you have clear workplace authorization and consent for every data source and person involved. Avoid private chats, DMs, browser-profile reuse, and broad workspace discovery unless your organization explicitly permits it. Use a dedicated least-privilege app/token, do not run the unpinned MCP path with valuable credentials, keep generated knowledge outside synced or shared folders, and review generated Skills before loading them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T08 · Insecure Dependencies
Error
- Location
tools/feishu_mcp_client.py:92- Finding
Unpinned npm Package Executes with Feishu Credentials in Its Environment
- Content
View full analysis
dict: """ 通过 npx 调用 feishu-mcp 工具。 feishu-mcp 支持 stdio 模式，直接 JSON 通信。 """ env = os.environ.copy() env["FEISHU_APP_ID"] = config.get("app_id", "") env["FEISHU_APP_SECRET"] = config.get("app_secret", "") if config.get("mode") == "user" and config.get("user_token"): env["FEISHU_USER_ACCESS_TOKEN"] = config["user_token"] payload = json.dumps({ "jsonrpc": "2.0", "method": "tools/call", "params": { "name": tool, "arguments": params, }, "id": 1, }) try: result = subprocess.run( ["npx", "-y", "feishu-mcp", "--stdio"], input=payload, capture_output=True, text=True, env=env, timeout=30, ) if result.returncode != 0: raise RuntimeError(f"MCP 调用失败：{result.stderr}") return json.loads(result.stdout) ``` The installation instructions reinforce the same unpinned dependency: ```bash npm install -g feishu-mcp ``` ### Technical Analysis The client invokes `npx -y feishu-mcp` without an exact version or integrity constraint. `npx -y` may automatically download and execute the package version currently resolved by the npm registry. The effective executable can therefore change after this Skill has been reviewed. The subprocess receives `FEISHU_APP_SECRET` and potentially `FEISHU_USER_ACCESS_TOKEN` in its environment. It is also intentionally authorized to retrieve corporate documents and messages. A compromised package release, registry account, dependency tree, or resolution path would therefore execute arbitrary code with the user's local privileges and direct acc ...[truncated 1252 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/feishu_auto_collector.py:67- Finding
Application Secrets, Access Tokens, and Collected Workplace Data Are Stored in Plaintext
- Content
View full analysis
dict: if not CONFIG_PATH.exists(): print("未找到配置，请先运行：python3 feishu_auto_collector.py --setup", file=sys.stderr) sys.exit(1) return json.loads(CONFIG_PATH.read_text()) def save_config(config: dict) -> None: CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) CONFIG_PATH.write_text(json.dumps(config, indent=2, ensure_ascii=False)) ``` The OAuth exchange persists access and refresh tokens in the same configuration: ```python if args.exchange_code: token_data = exchange_code_for_token(args.exchange_code, config) if token_data: config["user_access_token"] = token_data["access_token"] config["refresh_token"] = token_data.get("refresh_token", "") save_config(config) print(f"✅ user_access_token 已保存（scope: {token_data.get('scope', '')}）") print(f" token: {token_data['access_token'][:20]}...") ``` The same pattern appears in: - `tools/feishu_mcp_client.py:53-59` - `tools/dingtalk_auto_collector.py:54-60` - `tools/slack_auto_collector.py:98-105` Collected messages and documents are also written through ordinary `Path.write_text` calls, for example: ```python msg_path.write_text(msg_content, encoding="utf-8") doc_path.write_text(doc_content, encoding="utf-8") ``` ### Technical Analysis The collectors store application secrets, Slack bot tokens, Feishu access and refresh tokens, and DingTalk credentials in JSON files under `~/.colleague-skill`. Neither the configuration directory nor its files are assigned explicit restrictive permissions. Security therefore depends on the user's current umask and surrounding filesystem configuration. The collectors also persist private ...[truncated 1461 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
tools/feishu_auto_collector.py:238- Finding
Collectors Request and Exercise Excessive Access to Organizational and Private Data
- Content
View full analysis
Optional[dict]: """遍历部门查找用户（使用 tenant_access_token，需要 contact:department.base:readonly）""" print(f" 通过部门遍历查找 {name} ...", file=sys.stderr) # 递归获取所有部门 ID dept_ids = ["0"] # 0 = 根部门 queue = ["0"] while queue: parent_id = queue.pop(0) data = api_get( f"/contact/v3/departments/{parent_id}/children", {"page_size": 50, "fetch_child": False}, config, ) if data.get("code") != 0: if parent_id == "0": print(f" 部门遍历失败（code={data.get('code')}）：{data.get('msg')}", file=sys.stderr) print(f" 请确认已开通 contact:department.base:readonly 权限", file=sys.stderr) return None continue children = data.get("data", {}).get("items", []) for child in children: child_id = child.get("department_id", "") if child_id: dept_ids.append(child_id) queue.append(child_id) print(f" 共 {len(dept_ids)} 个部门，搜索用户 ...", file=sys.stderr) # 在每个部门中查找用户 matches = [] for dept_id in dept_ids: page_token = None while True: params = {"department_id": dept_id, "page_size": 50} if page_token: params["page_token"] = page_token data = api_get("/contact/v3/users/find_by_department", params, config) ``` Private-message collection retains both participants' messages: ```python def fetch_p2p_messages( chat_id: str, user_open_id: str, limit: int, c ...[truncated 2403 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/version_manager.py:50- Finding
Unvalidated Slug and Version Values Permit Path Traversal Outside the Colleague Directory
- Content
View full analysis
bool: """回滚到指定版本""" version_dir = skill_dir / "versions" / target_version if not version_dir.exists(): print(f"错误：版本 {target_version} 不存在", file=sys.stderr) return False # 先存档当前版本 meta_path = skill_dir / "meta.json" if meta_path.exists(): meta = json.loads(meta_path.read_text(encoding="utf-8")) current_version = meta.get("version", "v?") backup_dir = skill_dir / "versions" / f"{current_version}_before_rollback" backup_dir.mkdir(parents=True, exist_ok=True) for fname in ("SKILL.md", "work.md", "persona.md"): src = skill_dir / fname if src.exists(): shutil.copy2(src, backup_dir / fname) # 从目标版本恢复文件 restored_files = [] for fname in ("SKILL.md", "work.md", "persona.md"): src = version_dir / fname if src.exists(): shutil.copy2(src, skill_dir / fname) restored_files.append(fname) ``` The CLI constructs the Skill directory without validation: ```python base_dir = Path(args.base_dir).expanduser() skill_dir = base_dir / args.slug ``` `tools/skill_writer.py` uses the same construction: ```python skill_dir = base_dir / slug skill_dir.mkdir(parents=True, exist_ok=True) ``` ### Technical Analysis The `slug` and `target_version` values are accepted from CLI arguments and joined directly to trusted base paths. There is no character allowlist, rejection of absolute paths, normalization check, resolved-path containment check, or symlink defense. A slug such as `../../somewhere` can resolve ...[truncated 1566 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
tools/feishu_browser.py:45- Finding
Arbitrary URLs Are Opened Using the User's Persistent Chrome Profile
- Content
View full analysis
str: """抓取飞书文档或 Wiki 的文本内容""" page.goto(url, wait_until="domcontentloaded", timeout=30000) ``` The caller only performs path-substring type detection, not origin validation: ```python if args.url: page_type = detect_page_type(args.url) print(f"页面类型：{page_type}，开始抓取...", file=sys.stderr) if page_type == "sheet": content = fetch_sheet(page, args.url) else: content = fetch_doc(page, args.url) ``` ### Technical Analysis The tool launches Playwright with the user's default persistent Chrome profile, which may contain cookies, local storage, authenticated sessions, extension state, and browsing data for many services. It then navigates to the unvalidated `--url`. `detect_page_type` merely checks whether path substrings such as `/wiki/` or `/docx/` occur in the URL. It does not require HTTPS, validate the hostname, allowlist Feishu or Lark tenant domains, or ensure that redirects remain on an approved origin. An attacker-controlled ...[truncated 1699 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (143)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The README recommends third-party tools to export or decrypt WeChat chat records and then import them into the project, which directly facilitates surfacing private communications for AI processing. This is especially dangerous because chat records often contain intimate personal content, authentication details, customer data, and confidential work discussions that the data subject may never have consented to repurpose.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The marketing for the related project explicitly promotes importing private relationship chat histories, personality profiling, and building an AI replica, which normalizes processing extremely sensitive personal data. Even though it references a related project, this README uses that content to encourage adjacent behavior and lowers user caution around non-consensual collection, intimate-data exposure, and identity/personality replication.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Recommending tools for exporting and decrypting chat history provides operational guidance that can facilitate exposure of sensitive communications, especially when paired with a skill designed to ingest and distill that data. The skill context makes this more dangerous because the decrypted outputs are not merely viewed temporarily; they are intended to be imported, retained, and transformed into a persistent behavioral model.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
While framed as a mismatch finding, this item identifies real risky behavior: the skill instructs reuse of a local Chrome session and broad scraping of Feishu content, including chats and internal documents. That is dangerous because it normalizes covert access to sensitive third-party communications and enterprise data beyond a narrowly scoped, consent-driven workflow.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description does not clearly warn that the skill may collect private chats, internal documents, spreadsheets, emails, screenshots, and profile data about another person. That omission is dangerous because users may invoke the skill without understanding the sensitivity, consent implications, and downstream storage of third-party communications.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill tells the agent to send a real message to a target colleague purely to discover the private chat ID needed for later collection. This is dangerous because it performs an externally visible action affecting a third party without their consent and uses that action as a stepping stone to harvest private communications.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs browser-based scraping of DingTalk message history where the official API does not support it. Bypassing platform limitations through scraping is dangerous because it circumvents intended access controls and can capture sensitive messages in ways users and platform admins may not expect.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill promotes broad harvesting of internal docs, chats, and spreadsheets tied to a named colleague, including browser-session reuse and multi-source collection. In context, this makes the skill more dangerous because its explicit purpose is profiling a specific person over time, increasing the sensitivity and aggregation risk of the collected data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs reuse of the operator's local Chrome login session to access Feishu documents and content. This is dangerous because it leverages ambient authenticated state to access potentially sensitive enterprise data without robust consent, scope limitation, or clear auditing, increasing the risk of unauthorized third-party data exposure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow reaches private-chat collection and third-party contact/message actions without a strong just-in-time warning or consent checkpoint. This is dangerous because the agent may proceed into sensitive account actions and data access before the operator fully understands the privacy and compliance consequences.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to collect private chat histories and ingest credentials or access tokens as source material for generating outputs about a colleague. This is highly dangerous because it combines sensitive communications and authentication artifacts in a workflow that stores, analyzes, and transforms personal/enterprise data, creating substantial privacy, secrecy, and lateral-abuse risks.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 work.md + persona.md）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 work.md + persona.md）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 work.md + persona.md）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 6. 重新生成 `SKILL.md`（合并最新 work.md + persona.md）
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The skill includes a destructive
rm -rf colleagues/{slug}command parameterized by user-controlled input. If slug validation is weak, path traversal or malformed values could delete unintended files or directories, and even valid use causes irreversible destruction of stored data.- Content
/delete-colleague {slug}： 确认后执行：bash rm -rf colleagues/{slug}
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill is designed to write and edit skill files, including its generated colleague artifacts, and to evolve them over time from new inputs and corrections. Self-modifying or self-extending behavior is dangerous in a sensitive profiling workflow because untrusted or mistaken inputs can permanently alter persistent instructions and stored persona representations.
- Content
md | Feishu docs (MCP App Token) | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/feishu_mcp_client.py` | | DingTalk auto-collect | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/dingtalk_auto_collector.py` | | Parse email .eml/.mbox | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/email_parser.py` | | Write/update Skill files | `Write` / `Edit` tool | | Version management | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/version_manager.py` | | List existing Skills | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/skill_writer.py --action list` |
Static analysis
No suspicious patterns detected.