Security audit

飞书文档修订工具（高亮/下划线/批注）

Security checks across malware telemetry and agentic risk

Overview

This Feishu document skill appears purpose-related, but it embeds or permits a reusable app secret and can make persistent authenticated document changes with weak disclosure.

Review before installing. Only use this in a controlled Feishu tenant after removing any hardcoded or fallback app secret, rotating any exposed credential, and requiring explicit confirmation before each document write or comment post.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs execution of a shell script (`scripts/add_comment.sh`) but does not declare that capability in a permissions model. Hidden or undeclared execution capability reduces transparency and can enable unintended command execution paths, especially when user-controlled inputs like `doc_token` and comment text are passed into a script.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior does not match the actual operational guidance: highlighter/underline actions are described, but the skill also includes credential-handling and comment-posting via direct API/script usage, including mention of a built-in secret fallback. Behavior mismatches are dangerous because they hide privileged operations from users and reviewers, making it easier to smuggle sensitive actions or misuse credentials.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill expands from simple document markup into shell-scripted API posting using app credentials, which broadens its effective privilege and attack surface. This creates risk because a seemingly narrow editing skill can now access secrets and perform authenticated outbound actions beyond what a user may reasonably expect.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The script contains a hardcoded fallback Feishu app secret and uses it to obtain an access token, giving anyone with the script a reusable credential for authenticated API access. In a document-review skill, embedding platform credentials is not necessary for safe local annotation behavior and materially increases the risk of unauthorized access if the script is copied, logged, or exposed.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: Broad triggers like '标注一下' or 'review一下文档' can cause the skill to activate in ambiguous situations and modify live documents without sufficiently precise user intent. In a skill that performs write actions, overbroad invocation conditions materially increase the chance of unintended edits or comments.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill performs live modifications to Feishu documents and posts comments, but the description does not clearly warn users that it will make external, persistent changes. Lack of notice is risky because users may invoke the skill expecting analysis-only behavior and inadvertently alter production documents.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill states it will access app secrets and send authenticated requests to Feishu APIs without clearly warning users about secret access and outbound data transmission. This is dangerous because it obscures sensitive credential use and may expose document identifiers or comment contents to external services under app authority.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script sends the document token and comment content to Feishu APIs without any explicit disclosure, confirmation, or guardrail at execution time. Because this skill operates on user-provided document content, silent transmission can surprise users and may expose sensitive identifiers or text to an external service beyond what they expected.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script reads a sensitive credential from the environment but also includes a default secret value, which defeats secret-management controls and creates a built-in credential exposure. Anyone with access to the script can use the fallback secret to mint access tokens, potentially enabling unauthorized actions against Feishu resources.

Ssd 3

High

Confidence: 98% confidence
Finding: The instruction explicitly permits using a 'directly known' Feishu App Secret instead of only reading it from the environment, which strongly suggests acceptance of embedded or pre-shared secrets. Hardcoded or otherwise directly supplied secrets are a critical security issue because they can leak through source control, logs, prompts, or downstream tooling and enable unauthorized API access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.