T09 · Insecure Skill Coding Practices
Error
- Location
feishu-config.env:1- Finding
Live Feishu application credentials committed to the project
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Doc Orchestrator
Security checks for vulnerabilities and agentic risk
Overview
The skill is broadly consistent with creating Feishu documents, but it packages real-looking Feishu credentials and uses persistent tokens, remote code installation, and document permission changes that need careful review.
Review before installing. Rotate the packaged Feishu app secret if it was real, remove credential files from the package, pin or vendor any remote code, restrict API domains to official Feishu hosts, store tokens in a protected secret store, and require explicit confirmation before adding collaborators or transferring document ownership.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_config.py:77- Finding
Unvalidated API domain permits credential, OAuth code, token, and content exfiltration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
original-skill/feishu-doc-creator-with-permission/scripts/auto_auth.py:25- Finding
OAuth state is generated but not validated by the callback handler
- Content
View full analysis
授权失败授权失败
错误: {error}
请检查授权 URL 中的权限范围是否正确
""".encode('utf-8')) auth_code = f"ERROR: {error}" server_running = False return # 获取授权码 if 'code' in query_params: auth_code = query_params['code'][0] print(f"[OK] 收到授权码: {auth_code[:20]}...") ``` A state value is generated and sent, but not retained or checked by the callback: ```python scope = 'drive:drive docs:doc docx:document docs:permission.member:create offline_access' state = secrets.token_urlsafe(16) redirect_uri = config.get('FEISHU_OAUTH_REDIRECT_URI', 'http://localhost:8080/callback') port = int(redirect_uri.split(':')[-1].split('/')[0]) auth_url = ( f"https://accounts.feishu.cn/open-apis/authen/v1/authorize?" f"client_id={config['FEISHU_APP_ID']}" f"&redirect_uri={urllib.parse.quote(redirect_uri)}" f"&scope={urllib. ...[truncated 1749 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
original-skill/feishu-doc-creator-with-permission/scripts/auto_auth.py:139- Finding
User access and refresh tokens are stored in plaintext without restrictive permissions
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install_skill.py:23- Finding
Unpinned remote repository is cloned and its Python code is executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
original-skill/feishu-doc-orchestrator/scripts/orchestrator.py:85- Finding
Unvalidated workflow run name allows path traversal and writes outside the workflow directory
- Content
View full analysis
= 4: run_name = sys.argv[3] else: # 默认使用时间戳：run-YYYY-MM-DD-HHMMSS run_name = datetime.now().strftime("run-%Y-%m-%d-%H%M%S") # 工作流基础目录（在项目根目录下） project_root = Path(__file__).parent.parent.parent.parent # 上升到项目根目录 workflow_base_dir = project_root / "workflow" / "feishu-doc-runs" # 本次运行的工作流目录 workflow_dir = workflow_base_dir / run_name ``` It then creates and writes subdirectories without checking resolved containment: ```python step_dirs = { "parse": workflow_dir / "step1_parse", "create_with_permission": workflow_dir / "step2_create_with_permission", "add_blocks": workflow_dir / "step3_add_blocks", "verify": workflow_dir / "step4_verify" } for step_dir in step_dirs.values(): step_dir.mkdir(parents=True, exist_ok=True) ``` The wrapper passes incompatible option-style arguments to a positional parser: ```python cmd = [sys.executable, str(orchestrator_script), str(markdown_file)] if title: cmd.extend(["--title", title]) if doc_id: cmd.extend(["--doc-id", doc_id]) if verbose: cmd.append("--verbose") ``` ### Technical Analysis `pathlib.Path` does not automatically constrain a joined path to its intended parent. A value such as `../../target` remains capable of escaping `workflow/feishu-doc-runs` after path resolution. The orchestrator subsequently invokes several scripts that write predictable JSON and log files under the resulting directories. Existing files with the same names may be overwritten. The top-level wrapper and orchestrator also disagree about argument sy ...[truncated 1602 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (113)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Cloning remote repositories, copying directories from workspace, creating files in the user's home directory, and performing interactive installation are materially different from converting Markdown to Feishu documents. These actions modify the local environment and can introduce supply-chain, persistence, or integrity risks if hidden behind a broadly described productivity skill.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
The fallback access to
.claude/feishu-config.envreaches into an agent/application config directory that may contain sensitive credentials outside the skill's own working data boundary. In a skill ecosystem, reading from agent config paths is high risk because it enables implicit secret harvesting and use of broader-scoped credentials without clear user intent.- Content
python """加载飞书配置""" config_path = Path(__file__).parent.parent.parent.parent / "feishu-config.env" if not config_path.exists(): config_path = Path(".claude/feishu-config.env") config = {} if config_path.exists():
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The script explicitly reads from the agent configuration area (.claude/feishu-config.env), which is a sensitive directory likely to contain app secrets. In a skill context, access to agent-managed config is more dangerous because it crosses from document processing into credential retrieval, and could expose FEISHU_APP_SECRET or related secrets to any code path that reuses this helper.
- Content
python config_path = project_root / ".claude" / "feishu-config.env" if not config_path.exists(): config_path = Path(".claude/feishu-config.env") config = {} if config_path.exists():
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The script prints the first 30 characters of the access token to stdout after successful authorization. Even partial credential disclosure is sensitive because terminal logs, shell history capture, CI logs, screen recordings, or shared consoles can leak reusable token material and aid token theft or correlation with other exposed data.
- Content
python print("=" * 70) print("授权成功！") print("=" * 70) print(f"Access Token: {token_data['access_token'][:30]}...") print(f"有效期: {token_data['expires_at'] - int(time.time())} 秒") print(f"权限范围: {token_data['scope']}") print()
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
The script accesses files under the agent's .claude directory to read configuration and later reads stored tokens from .claude/feishu-token.json. In an agent-skill setting, access to the agent config directory is sensitive because it may expose secrets and account credentials beyond the immediate task, and the skill uses those secrets to perform authenticated actions against an external service.
- Content
python project_root = Path(__file__).parent.parent.parent.parent.parent config_path = project_root / ".claude" / "feishu-config.env" if not config_path.exists(): config_path = Path(".claude/feishu-config.env") config = {} if config_path.exists():
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The fallback read from .claude/feishu-config.env accesses the agent configuration area, which commonly stores sensitive tokens and secrets outside the skill's own declared inputs. In a skill ecosystem, reaching into agent config directories is dangerous because it broadens secret access and may bypass normal consent and scoping expectations.
- Content
python """加载飞书配置""" config_path = Path(__file__).parent.parent.parent.parent / "feishu-config.env" if not config_path.exists(): config_path = Path(".claude/feishu-config.env") config = {} if config_path.exists():
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
如果需要重新登录（如登录过期）：
bash # 删除登录状态 rm -rf .claude/playwright_state # 再次运行验证器，会提示重新扫码 python .claude/skills/feishu-doc-verifier/scripts/doc_verifier.py <doc_info.json>
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
The script reads secrets and tokens from the agent's .claude directory, including app credentials and user access tokens, which are highly sensitive. In a skill environment, accessing agent-local config/token stores increases the blast radius: if the skill is triggered unexpectedly or repurposed, it can use standing credentials to modify external resources without fresh user authorization.
- Content
python project_root = Path(__file__).parent.parent.parent.parent config_path = project_root / ".claude" / "feishu-config.env" if not config_path.exists(): config_path = Path(".claude/feishu-config.env") config = {} if config_path.exists():
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This script can transfer ownership of an existing Feishu document to another user, which goes beyond the stated skill purpose of Markdown-to-document conversion and collaborative document creation. In an agent/skill context, this is sensitive privilege-changing behavior that could reassign control of user content if invoked on arbitrary document IDs, especially since the script accepts target IDs directly from CLI input and performs no authorization or scope checks tied to user intent.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python cmd.append("--verbose") # 设置环境变量 env = os.environ.copy() config_file = load_config() if config_file: # 设置配置路径环境变量
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python cmd.append("--verbose") # 设置环境变量 env = os.environ.copy() config_file = load_config() if config_file: # 设置配置路径环境变量
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for converting Markdown into Feishu documents with block and permission support, but this file contains a fully authored UI/UX design specification for an "AgentForge" web interface, including design system, component lists, and export recommendations. That behavior/content is semantically different from Markdown conversion and suggests the skill is being used to generate unrelated design deliverables rather than orchestrating Feishu document creation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises significant capabilities involving environment access, file I/O, shell execution, and network calls, but it does not declare any tool scope or permission boundaries. This weakens user and platform visibility into what the skill can do and increases the risk of over-privileged execution, especially because the workflow handles secrets and remote APIs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation language is broad enough to match general document-sharing or collaboration requests, which can cause the skill to run in situations beyond its safe intended scope. Given the presence of credential, permission, filesystem, and network capabilities, overbroad auto-invocation increases the chance of unnecessary privileged actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Ambiguous trigger conditions without negative examples make it harder for the agent to distinguish between safe conversion requests and broader document-related tasks. In this context, that ambiguity is dangerous because the skill appears capable of authentication, permission changes, local writes, and network activity that should not be auto-triggered casually.
- Content