Feishu Project(Meego) Connector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:37 PM UTC
• Version: 1.0.10

Overview

The skill appears to be a real Feishu Project connector, but it asks the agent to handle OAuth credential files and runs an unpinned npm tool that could change after review.

Review this skill before installing. Prefer the browser OAuth path where the agent does not see credential contents, avoid pasting authorized credential files into chat, restrict Feishu OAuth permissions to the minimum needed, and use a pinned, verified version of @lark-project/meego-mcporter rather than unversioned npx commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

--config meego-config.json ``` ### Technical Analysis The Skill installs or invokes `@lark-project/meego-mcporter` without specifying an exact reviewed version or integrity value. When the package is unavailable locally, `npx` can retrieve the currently resolved release from the npm registry and execute it with the privileges of the user running the agent. Consequently, the code that ultimately executes can differ from the code present when this Skill was audited. A compromised publisher account, malicious future release, registry compromise, or other supply-chain incident could cause users to execute altered package code. This risk is particularly significant because the dependency performs OAuth authentication and manages `~/.mcporter/credentials.json`. Although access to that credential file is necessary for the declared Feishu OAuth functionality and the Skill includes appropriate user-confirmation and storage restrictions, those textual restrictions cannot constrain a compromised npm package. ### Attack Path 1. An attacker compromises the npm publisher account, release process, or another component of the package distribution chain. 2. The attacker publishes an altered v ...[truncated 1386 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read ~/.mcporter/credentials.json and display its contents to the user. Even if the file is expected to contain only OAuth client parameters at that moment, this creates a dangerous pattern where the agent accesses a credential store directly, and any state mismatch, prior auth, or file confusion could expose tokens or other secrets into chat history.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

**步骤 A — 向用户展示 OAuth 客户端配置（需用户确认）：**

读取 `~/.mcporter/credentials.json` 的内容（此时仅包含 OAuth 客户端参数，不含 token），向用户展示并告知：

> 以下是 OAuth 客户端配置，请参考文档 https://project.feishu.cn/b/helpcenter/1ykiuvvj/1n3ae9b4 在本地电脑中完成授权，授权完成后请将生成的凭证文件提供给我。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs the agent to accept a user-provided authorized credential file and write it into ~/.mcporter/credentials.json. This places raw secrets directly into the agent workflow, increasing the risk of accidental logging, prompt retention, mishandling of file contents, or credential substitution attacks if the file is malformed or maliciously crafted.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

**步骤 B — 接收用户提供的已授权凭证（需用户确认）：**

用户在本地完成 OAuth 后会提供已授权的凭证文件。在得到用户确认后，将其写入 `~/.mcporter/credentials.json`。

写入完成后，立即清理操作过程中可能产生的任何中间临时文件。凭证内容仅存储在 `~/.mcporter/credentials.json`，不得保存到其他任何位置。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Although this line says credentials must only be stored in ~/.mcporter/credentials.json and temporary files must be cleaned up, it confirms the workflow involves the agent handling authorized credential material. That is still dangerous because the agent may inadvertently persist secrets in logs, memory, traces, or intermediate artifacts outside the intended file.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

用户在本地完成 OAuth 后会提供已授权的凭证文件。在得到用户确认后，将其写入 `~/.mcporter/credentials.json`。

写入完成后，立即清理操作过程中可能产生的任何中间临时文件。凭证内容仅存储在 `~/.mcporter/credentials.json`，不得保存到其他任何位置。

#### 3.4. 验证授权结果

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill metadata installs and runs an npm-delivered MCP component without a pinned version, allowing the executed code to change over time. If the upstream package is compromised or a malicious version is published, the agent could fetch and run attacker-controlled code during install or invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The OAuth command uses npx to fetch and execute @lark-project/meego-mcporter without specifying an exact version. This creates a supply-chain execution risk because a different package version may be retrieved later and run with access to the user's environment and credentials flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The remote OAuth bootstrap command again executes an unpinned npm package via npx. Because this step participates in credential setup, compromise of the package could expose OAuth client data, alter the auth flow, or capture tokens once the credential file is written.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The operational call example uses npx without a pinned version, so every later tool invocation may execute changed upstream code. Since the tool can query and modify project data, a compromised package could abuse both local credentials and remote Meego permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.