Security audit

柳比歇夫时间记录

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Feishu time-tracking skill that creates, reads, and writes the expected Feishu tables, with no evidence of hidden exfiltration or destructive behavior.

Install only if you want this agent to use your Feishu account to create tables and store activity/report data. Prefer a dedicated or least-privilege Feishu workspace, keep Base Tokens/Table IDs private, use dry-run where available, and configure the host so casual mentions of activities or reports are not saved unless you intended to record them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill declares no permissions, yet its documented behavior requires executing shell commands such as python3 scripts/setup.py, python3 scripts/daily_report.py, pip install, and lark-cli auth/login. This creates a capability transparency gap: reviewers and users may believe the skill is passive JSON formatting, while it actually relies on local command execution and external service interaction.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The public description presents the skill as a simple time-tracking assistant, but the document also instructs creation of Feishu tables, field provisioning, login checks, and report-generation scripts that read/write remote data. This mismatch can cause unsafe deployment decisions because operators may grant trust or route user data to a skill whose real behavior is broader and more privileged than advertised.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly states that personal activity and energy-tracking data is stored in Feishu, including timestamps, habits, tags, and potentially identity-linked '记录人' fields, but it does not warn users about third-party data transmission, retention, access scope, or privacy implications. In a productivity skill handling sensitive behavioral data, this omission can lead users to share more personal information than they would if the data flow were clearly disclosed.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The documented trigger phrase includes very broad commands such as '日报' and '生成日报', which are common conversational phrases and may be invoked unintentionally during ordinary chat. In an agent environment with automation and write-capable integrations, accidental triggering can cause unwanted report generation, data reads, or writes to Feishu without deliberate user intent.

Vague Triggers

High

Confidence: 88% confidence
Finding: Triggering on essentially any user description of an activity is overly broad and can cause the skill to activate in unrelated conversations. In context, that can lead to unintended extraction of user text into structured records, accidental diary/log creation, or invocation of downstream storage/reporting flows without sufficiently clear user intent.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The daily report trigger uses broad phrasing that may match casual mentions of '日报' rather than an actual request to generate and write a report. Because report generation is tied to scripts that read/write Feishu data, ambiguous activation increases the risk of unintended processing, data mutation, or unnecessary scheduled/reporting actions.

Static analysis

No suspicious patterns detected.