Feishu Project(Meego) Connector - Bytedance Internal Version

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:38 PM UTC
• Version: 1.0.10

Overview

The skill has a coherent Meego connector purpose, but it asks agents to handle OAuth credential files and runs an unpinned npm package during authentication and later operations.

Review before installing. Prefer the browser OAuth flow so the agent never sees raw credentials. Avoid pasting authorized credential files into chat; place them out-of-band with strict file permissions if the remote flow is required. Pin and review the npm package version before running the documented npm/npx commands, and use an OAuth account with the minimum Meego permissions needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31, SKILL.md:65, SKILL.md:80, and SKILL.md:109
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npm install -g @lark-project/meego-mcporter

bash

npx @lark-project/meego-mcporter auth meego_btd --config meego-config.json

bash

npx @lark-project/meego-mcporter auth meego_btd --config meego-config.json --oauth-timeout 1000

bash

npx @lark-project/meego-mcporter call meego_btd <tool_name> --config meego-config.json

Technical Analysis

The Skill instructs users or agents to install and execute @lark-project/meego-mcporter without specifying an exact version or verifying package integrity. When no version is specified, npm and npx ordinarily resolve the package version through the configured registry. In particular, npx can download and immediately execute a package that is not already installed.

Consequently, the effective executable code is not fixed to the content reviewed in this Skill. A future package release, compromised publisher account, registry compromise, or unsafe registry configuration could cause different code to execute under the same documented command. The project provides no lockfile, integrity digest, signature verification procedure, or vendored source through which the executed dependency can be matched to an audited release.

This risk is amplified because the downloaded program is intentionally given access to OAuth operations and to ~/.mcporter/credentials.json. Although credential-file access is functionally necessary for the declared OAuth integration and the documentation includes reasonable user-confirmation requirements, those textual constraints cannot restrict a compromised npm package after it starts executing.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry ...[truncated 1527 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version in every command, for example:

   bash

   npx --yes @lark-project/meego-mcporter@1.0.10 auth meego_btd --config meego-config.json
   

   The selected version must be independently reviewed rather than assumed safe from the example.

2. Prefer a normal project installation governed by a committed lockfile over downloading packages implicitly during each invocation.

3. Require integrity verification using a trusted package digest, signed release metadata, or an internally controlled package mirror.

4. Separate installation from execution. Inform the user when a package must be downloaded, obtain explicit approval, verify its source and version, and then invoke the already installed binary.

5. Disable lifecycle scripts during installation where compatible with the package:

   bash

   npm install --ignore-scripts --save-exact @lark-project/meego-mcporter@<reviewed-version>
   

6. Execute the MCP client with least privilege in a restricted environment that exposes only the required configuration and credential file. Do not grant administrative privileges.

7. Restrict ~/.mcporter/credentials.json to the owning user, avoid displaying authorized tokens in chat or logs, and use a secure file-transfer channel for the remote OAuth workflow.

8. Re-audit dependency updates before changing the pinned version, including transitive dependencies and install scripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This step instructs the agent to read ~/.mcporter/credentials.json and display its contents to the user. Even if the text claims the file contains only client parameters at that moment, the same path is also used for OAuth tokens elsewhere; a state mismatch, prior auth, or operator mistake could result in live credentials being exposed into chat, logs, or transcripts.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

**步骤 A — 向用户展示 OAuth 客户端配置（需用户确认）：**

读取 `~/.mcporter/credentials.json` 的内容（此时仅包含 OAuth 客户端参数，不含 token），向用户展示并告知：

> 以下是 OAuth 客户端配置，请参考文档 https://bytedance.larkoffice.com/wiki/UspfwpHaFi6LxQkt9xBcIS54nNg 在本地电脑中完成授权，授权完成后请将生成的凭证文件提供给我。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill directs the agent to accept a user-provided authorized credential file and write it into ~/.mcporter/credentials.json, which means the agent handles raw secret material directly. This creates significant risk of credential leakage through temporary files, prompts, logs, shell history, or accidental reuse, especially in an agent environment where content may be persisted.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

**步骤 B — 接收用户提供的已授权凭证（需用户确认）：**

用户在本地完成 OAuth 后会提供已授权的凭证文件。在得到用户确认后，将其写入 `~/.mcporter/credentials.json`。

写入完成后，立即清理操作过程中可能产生的任何中间临时文件。凭证内容仅存储在 `~/.mcporter/credentials.json`，不得保存到其他任何位置。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Although this line says credentials must only be stored in ~/.mcporter/credentials.json and temporary files must be cleaned up, it confirms a workflow where the agent directly manipulates token-bearing material. In practice, such handling is dangerous because agent systems often retain command inputs, outputs, and intermediate artifacts outside the intended location, undermining the stated safeguard.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

用户在本地完成 OAuth 后会提供已授权的凭证文件。在得到用户确认后，将其写入 `~/.mcporter/credentials.json`。

写入完成后，立即清理操作过程中可能产生的任何中间临时文件。凭证内容仅存储在 `~/.mcporter/credentials.json`，不得保存到其他任何位置。

#### 3.4. 验证授权结果

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The entire skill description and user-facing instructions are written only in Chinese, including mandatory interaction guidance such as asking the user to choose an auth method and credential-handling steps. This imposes a specific language/locale without any documented opt-in or alternative language option, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill metadata declares use of npx/Node-installed tooling without pinning an exact package version, which means execution may resolve to a newer or compromised release at runtime. Because this skill is specifically designed to install and execute an MCP connector, a supply-chain compromise would directly lead to untrusted code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx @lark-project/meego-mcporter auth ... fetches and executes a package without an explicit version pin, allowing unexpected package changes or dependency compromise to alter what code runs during authentication. Since this step occurs in a credential-handling flow, malicious package updates could capture OAuth data or tamper with local credential storage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This unpinned npx invocation is used in the remote OAuth flow, where users are instructed to generate client configuration and later handle credential material. If the package resolution changes or the npm package is compromised, the executed code could manipulate or exfiltrate OAuth configuration and tokens from ~/.mcporter/credentials.json.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The operational call command executes the MCP connector through an unpinned npx package reference, so every later use may run different code than originally reviewed. In an integration that can query and modify work items, package compromise could lead to unauthorized actions, data access, or persistence through repeated use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.