Feishu Invoice Approval

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.2

Overview

This skill scaffolds a disclosed Feishu/Lark invoice approval bot with meaningful safety gates, though users should treat it as a sensitive finance workflow integration.

Install only if you intend to operate a Feishu/Lark invoice approval bot. Keep dry-run on during setup, grant the Feishu app only the listed permissions, use an allowed-sender list for production, protect the generated data directory and SQLite database, and enable real submissions only after explicit authorization and testing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a fully featured Feishu/Lark invoice approval bot with substantial workflow and automation capabilities. The supplied code chunk contains only package metadata and version information, with no operational logic, integrations, triggers, or resource access. Because the actual code does not implement or evidence the described functionality, the description does not accurately represent this code chunk.

Credential Access

High

• Category: Privilege Escalation

Content

.env
.venv/
__pycache__/
*.py[cod]

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.env
.venv/
__pycache__/
*.py[cod]

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.env
.venv/
__pycache__/
*.py[cod]

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

.env
.venv/
__pycache__/
*.py[cod]

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Credential Access

High

• Category: Privilege Escalation

Content

@classmethod
    def from_env(cls, project_dir: Optional[Path] = None) -> "Settings":
        root = (project_dir or Path(__file__).resolve().parents[2]).resolve()
        load_dotenv(root / ".env")

        def rooted(env_name: str, default: str) -> Path:
            value = Path(os.getenv(env_name, default))

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
python3 <skill-directory>/scripts/scaffold.py --target <target-directory>
cd <target-directory>
cp .env.example .env
cp config/approval_mapping.example.json config/approval_mapping.json
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

print(f"Created Feishu invoice approval bot project at {target}")
    print("Next:")
    print(f"  1. cp {target / '.env.example'} {target / '.env'}")
    print(
        "  2. cp "
        f"{target / 'config' / 'approval_mapping.example.json'} "

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The descriptions require a Chinese reimbursement type and a concise Chinese approval summary, which imposes a specific language/locale in natural-language instructions. This matches the policy category for language or locale constraints when no user opt-in or alternative is provided.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This code uses Chinese in the module docstring and throughout card titles, subtitles, labels, and button text, implying the skill experience is fixed to a single language. Because there is no user opt-in, locale selection, or documented region-specific justification in this file, it may violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code emits user-facing CLI text in Chinese such as error/help-related status messages, and the command description/help strings later in the file are also Chinese-only. The file provides no language selection, opt-in, or documented justification for enforcing a Chinese locale, which matches the policy's language/locale violation criterion.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The argparse description and subcommand help text are presented only in Chinese, which forces a specific language for all users of the CLI. There is no mechanism in this file to let users select another language or any documented region-specific rationale.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The exception message is hard-coded in Chinese, which imposes a specific language on users without any opt-in or documented locale justification. The policy applies to natural-language strings in code as well as documentation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Several configuration error messages are hard-coded in Chinese, including messages at L68, L80, and L82. This creates a language/locale policy issue because the skill does not provide a language choice or clearly justify a Chinese-only scope in this file.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

input_text: Optional[str] = None,
    ) -> Dict[str, Any]:
        try:
            completed = subprocess.run(
                [self.binary, *args],
                cwd=str(cwd) if cwd else None,
                input=input_text,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"bot",
                ]
                try:
                    process = subprocess.Popen(
                        command,
                        stdin=subprocess.PIPE,
                        stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This Python file embeds a fixed Shanghai timezone at L015 and emits user-facing error strings only in Chinese at L021-L028. The stated policy flags language or locale constraints when a skill forces a specific language or locale without user opt-in, and this file provides no mechanism to select another language or timezone.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file’s user-facing and descriptive natural language is entirely in Chinese, indicating the skill is designed around a fixed language/locale. Under the policy criteria, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy concern.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code stores the entire incoming event payload in SQLite via `event_json`, and the schema also persists identifiers such as chat and sender IDs plus invoice and approval data. There is no confirmation prompt, user-facing log/print, or warning in this file indicating that user-submitted data will be retained on disk.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The embedded natural-language prompt requires Chinese behavior, including 'approval_summary' in concise Chinese and 'currency' fixed to CNY. This imposes a specific language/locale policy in the skill logic without any visible user opt-in or explanation that the skill is intentionally limited to a China-specific invoice workflow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command.append(VISION_PROMPT)

        try:
            completed = subprocess.run(
                command,
                capture_output=True,
                text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This JSON template uses Chinese-only instructional text and field labels throughout, such as the approval code guidance and expense type labels. Because the file provides no indication that the skill is China-specific or that users may choose another language, it appears to enforce a specific locale without opt-in.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The build dependency is specified as "setuptools>=68" without an upper bound or exact pin, so builds may resolve to different setuptools versions across environments, including versions with known advisories. While this file does not itself invoke a vulnerable code path, leaving the version unpinned weakens supply-chain assurance and can expose users to vulnerable tooling during package build or installation.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

process_event.add_argument("path", type=Path)
    args = parser.parse_args(argv)
    logging.basicConfig(
        level=getattr(logging, args.log_level),
        format="%(asctime)s %(levelname)s %(name)s %(message)s",
    )

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

No suspicious patterns detected.