Security audit

Feishu Sheet Links

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Feishu link-extraction purpose, but its optional downloader has under-scoped browser and file-write behavior that users should review before installing.

Install only if you are comfortable with a skill that controls Chrome, visits all links found in a public Feishu sheet, and writes local files. Review extracted URLs before downloading, avoid using an authenticated or personal debugging Chrome profile, choose a low-risk output directory, and prefer a locally installed trusted Bun runtime instead of the unpinned npx command.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download.ts:181
Finding: Path Traversal Through Untrusted Spreadsheet Sheet Names
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/download.ts:127
Finding: Unrestricted Browser Navigation Allows Access to Internal Resources
Content: View full analysis
("Target.createTarget", { url }); const { sessionId: sid } = await cdp.send<{ sessionId: string }>( "Target.attachToTarget", { targetId, flatten: true } ); ``` Only two exact hostnames are denied: ```ts const domain = new URL(url).hostname; if (SKIP_DOMAINS.has(domain)) { console.log(`[${i + 1}/${total}] SKIP ${text.slice(0, 50)}`); progress[url] = { status: "skipped" }; writeFileSync(progressPath, JSON.stringify(progress, null, 2)); return; } ``` The program can also reuse a pre-existing debugging browser: ```ts export async function findExistingChrome( ports = [64023, 9222, 9229] ): Promise { for (const port of ports) { const info = await fetchJson<{ webSocketDebuggerUrl?: string }>( `http://127.0.0.1:${port}/json/version`, 2_000 ); if (info?.webSocketDebuggerUrl) { return info.webSocketDebuggerUrl; } } return null; } ``` ### Technical Analysis URLs loaded by `download.ts` originate from the links JSON and may ultimately be controlled by spreadsheet content. The code parses the hostname but applies only a two-entry denylist. It does not: - Restrict navigation to `https:`. - Require an approved set of public hostnames. - Reject loopback, private, link-local, multicast, or reserved IP addresses. - Resolve domain names and validate the resulting addresses. - Revalidate redirect destinations. - Prevent browser-specific or local-resource URL schemes. - Isolate untrusted navigation from an existing authenticated Chrome session. As a ...[truncated 1955 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:29
Finding: Unpinned Runtime Package Is Downloaded and Executed Through npx
Content: View full analysis
" -o feishu-links.json ``` ```bash npx -y bun "${SKILL_DIR}/scripts/download.ts" feishu-links.json \ -o \ -c 5 \ --max-wait 20000 ``` Equivalent commands also appear in `README.md:39-45`. ### Technical Analysis The documented workflow invokes `bun` through `npx -y`. If a suitable package is not already cached, `npx` may resolve and download a package named `bun` from the configured npm registry and execute it without interactive confirmation. The command does not specify an exact package version, lockfile, checksum, registry, or integrity value. Therefore, the effective runtime component may change after the Skill has been audited. This creates unnecessary supply-chain variability despite the project otherwise having no declared npm dependencies. This finding does not establish that the current `bun` package is malicious. The risk arises from dynamically resolving and executing an unpinned package during normal Skill operation. ### Attack Path 1. The victim invokes the Skill according to `SKILL.md`. 2. The environment does not already provide the expected executable in a manner that prevents package resolution. 3. `npx -y` resolves the package from the configured registry without asking for confirmation. 4. A compromised, replaced, or unexpectedly changed package version is downloaded. 5. Package-provided code executes with the permissions of the user running the Skill. 6. A malicious dependency could access files, environment variables, browser profiles, or network resources available to that user. ### Impact Assessment If the dynamically retrieved runtime package or its distribution path were compromised, attacker-controlled code could execute with the ful ...[truncated 356 chars]
Remediation: View remediation
" -o feishu-links.json ``` 2. Document installation from Bun's official distribution channel rather than relying on implicit npm package resolution. 3. Check the runtime version before execution and enforce a reviewed version range or exact version where operationally feasible: ```bash bun --version ``` 4. If `npx` must be supported, specify an exact reviewed package version and use a trusted registry configuration. Prefer an integrity-verifiable installation mechanism. 5. Keep the installation instructions consistent across `SKILL.md`, `README.md`, and `README_CN.md` so users do not fall back to the unpinned command. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description understates important behaviors: it writes local files and attaches to or launches Chrome, potentially inspecting a live browser context via CDP. When implementation capabilities exceed the declared purpose, users and policy systems may approve a skill without understanding that it can access broader browser/session data or create local artifacts.
Content: No source excerpt is available for this finding.

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 96% confidence
Finding: The skill searches ~/.claude/skills and /workspace/.claude/skills, which accesses agent configuration directories rather than using a provided, scoped path. Access to these locations can reveal local configuration/layout information and becomes more dangerous because the same skill also attaches to browser instances and runs executable commands, increasing the blast radius if modified or repurposed.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Resolve the skill directory:

bash
SKILL_DIR="$(find ~/.claude/skills /workspace/.claude/skills -maxdepth 1 -name feishu-sheet-links -type d 2>/dev/null | head -1)"

Run the extraction script:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to execute npx -y bun without pinning a specific version, which means the latest package matching bun from the npm registry will be fetched and executed at runtime. If the registry package is compromised, typo-confused, or changes behavior, users could run unintended code on their systems; this is more concerning in a skill context because the documentation directly encourages copy-paste execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This second npx -y bun invocation has the same supply-chain risk: it downloads and runs an unpinned package from the registry at execution time. Because this command is used for batch downloading content, it is likely to be run by end users as documented, so a compromised upstream package could achieve arbitrary code execution in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes networked code and reads environment-dependent locations but does not declare any tool scope or permissions boundary. That makes the capability surface implicit rather than auditable, increasing the chance an agent executes network/file-affecting behavior without clear user or platform review.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 90% confidence
Finding: Enumerating ~/.claude/skills and /workspace/.claude/skills discloses the existence and layout of locally installed skills. Even though this example filters for one name, it still probes sensitive agent-specific directories and normalizes a pattern that can be extended to inventory local capabilities for follow-on abuse.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Resolve the skill directory:

bash
SKILL_DIR="$(find ~/.claude/skills /workspace/.claude/skills -maxdepth 1 -name feishu-sheet-links -type d 2>/dev/null | head -1)"

Run the extraction script:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx -y bun without a pinned version allows retrieval of whatever package/version is current at execution time. This creates a supply-chain risk where compromised or unexpected upstream changes can alter behavior and execute arbitrary code on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The second npx -y bun invocation has the same unpinned remote-execution risk as the first: execution depends on live package resolution at run time. An attacker controlling or poisoning the package supply chain could obtain code execution in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The usage string instructs users to run the script via npx -y bun, which pulls and executes the latest bun package without pinning a specific version or verifying integrity. If the upstream package is compromised or a malicious version is published, users could execute attacker-controlled code before this downloader even runs; because this skill is explicitly designed to download external Feishu-linked content, its workflow already encourages network-reliant execution and makes supply-chain trust more important, not less.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The usage string instructs execution via npx -y bun without pinning a specific package version, which allows whatever version is current in the registry at runtime to be installed and executed. If the package is compromised, typosquatted, or updated with malicious code, users running the documented command could execute untrusted code on their system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes batch-downloading linked articles into local Markdown files but does not clearly warn that this step will make outbound requests to every extracted external URL and write untrusted remote content to disk. In the context of a link-extraction/download skill, that omission increases the risk of users unintentionally contacting attacker-controlled hosts, downloading harmful or sensitive content, or storing dangerous Markdown/HTML payloads locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill writes extracted link data to feishu-links.json as part of its normal workflow but does not clearly warn the user about this file-creation side effect before doing so. Unexpected local writes can expose sensitive link inventories, clutter workspaces, or conflict with user expectations in restricted environments.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cdp.ts:59

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/cdp.ts:11