Feishu Doc Orchestrator

• Outcome: Review
• Latest audit: May 28, 2026 · 10:26 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a Feishu document-conversion tool, but it needs Review because it ships Feishu app credentials and can upload local files, change document ownership, and persist login/session data.

Install only after reviewing the code and configuration. Replace and rotate the bundled Feishu app credentials, use your own least-privilege Feishu app, run it only on trusted Markdown, review every referenced local image path before conversion, disable or avoid automatic ownership transfer unless intended, and protect or delete saved OAuth tokens, Playwright state, screenshots, and workflow logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

auto_auth_script = Path(__file__).parent / "auto_auth.py"
        if auto_auth_script.exists():
            import subprocess
            result = subprocess.run(
                [sys.executable, str(auto_auth_script)],
                capture_output=False,
                text=True

• Confidence: 90% confidence
• Finding: result = subprocess.run( [sys.executable, str(auto_auth_script)], capture_output=False, text=True )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"[安装] 正在克隆仓库: {repo_url}")
    
    try:
        result = subprocess.run(
            ["git", "clone", repo_url, str(original_skill)],
            capture_output=True,
            text=True

• Confidence: 96% confidence
• Finding: result = subprocess.run( ["git", "clone", repo_url, str(original_skill)], capture_output=True, text=True )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises substantial capabilities including environment access, file I/O, shell, and network use, but does not declare permissions or boundaries. This weakens user oversight and allows a document-conversion skill to access local secrets, modify files, or make external requests without clear consent, increasing the chance of unexpected or abusive behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is Markdown-to-Feishu conversion, but the described behavior extends into OAuth flows, browser automation, token storage, permission/ownership management, local logging, and package acquisition. This is security-relevant scope expansion: credentials may be collected or persisted, browser state may be stored, and document permissions may be altered beyond what users expect from a simple conversion skill.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code reads client credentials from a local config file and later stores OAuth tokens on disk, creating a persistent credential store in the project directory. If the workstation, repository, backups, or logs are exposed, these secrets can be reused to access Feishu resources beyond the immediate session, especially because refresh tokens are also persisted.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill automatically acquires user OAuth tokens when a token file is missing, which goes beyond simple document conversion/creation into account authorization and credential handling. This increases risk because the skill can initiate sensitive access flows without a separate trust boundary or explicit consent at the time of use.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code transfers document ownership to another user, which is a materially more sensitive operation than ordinary collaboration management. Ownership transfer can permanently change control over the document and may expose content or administrative control to unintended recipients if misconfigured.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Executing a local subprocess to run an authorization helper gives the skill an extra execution primitive not necessary for basic document creation. In an agent/skill context, this is more dangerous because it can trigger local code with side effects and broaden the attack surface beyond expected API interactions.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This test script goes beyond creating and populating a Feishu document: it automatically grants a configured collaborator full access and then attempts to transfer ownership. In a skill whose stated purpose is Markdown-to-Feishu conversion, these side effects create an unnecessary privilege and control change that could expose documents or permanently hand them to another account without the operator fully realizing it.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module docstring frames the script as a comprehensive block-type test with standards-compliant permission handling, but the implementation silently performs broad access grants and ownership transfer as part of the test flow. That mismatch is dangerous because reviewers or users may underestimate the script's side effects and run it in environments containing real credentials and production tenants.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The verifier stores reusable Feishu browser state under a shared project directory, which can preserve authenticated session material beyond the immediate verification task. If other local tools, users, or later workflow steps can access that directory, they may reuse the session to access Feishu resources without re-authentication.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The script captures a screenshot of the visited Feishu document and writes it to disk, which may expose document contents or metadata to anyone with filesystem access. Even if intended for debugging or proof of verification, this creates an additional persisted copy of potentially sensitive content not strictly required for basic page-load validation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This script performs permission grants and ownership transfer on existing Feishu documents, which is materially broader and more sensitive than the stated skill purpose of converting Markdown into Feishu documents. In an agent skill context, this expands the blast radius from content creation to administrative control over user documents, enabling unauthorized sharing or takeover if invoked improperly.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script reads local app secrets and user access tokens from files in order to modify document permissions and ownership, which gives the skill access to sensitive credentials unrelated to simple Markdown conversion. In an agent environment, this creates a powerful capability for silent administrative actions against user resources if the skill is triggered or modified unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI includes installation logic that downloads a separate skill repository, which is outside the declared Markdown-to-Feishu conversion function. Hidden capability expansion is dangerous because users invoking a document tool may not expect network retrieval and code installation side effects.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Invoking git to clone and install external code is an unjustified privileged capability for a document-conversion skill and creates a direct software supply-chain exposure. A compromised repository, account, dependency, or network path could result in malicious code being staged and then executed by the host environment.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger conditions are broad enough that the skill could activate for loosely related requests involving documents, publishing, collaboration, or batch processing. Over-broad activation increases the risk that a high-capability skill runs in the wrong context and unnecessarily gains access to files, tokens, network operations, or permission-management actions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Saying the skill will 'automatically activate' without concrete trigger phrases, prerequisites, or exclusions creates ambiguity and may cause the agent to invoke it unexpectedly. In this context, unexpected activation is more dangerous because the skill is associated with external API access, local file handling, and permission-management features.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly advertises automatic collaborator addition and ownership transfer, but does not warn users that these actions can immediately and materially change document access control. In a document-creation skill, silent permission mutation is security-relevant because it can expose sensitive content to other accounts or irreversibly hand control to another principal if used without informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README states that local images are automatically uploaded from filesystem paths, but does not warn that local file contents will be transmitted to Feishu. This is dangerous because users may reference local files assuming only formatting conversion occurs, while the skill actually exfiltrates image data from the local machine to a remote service.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README mentions automatic saving of login state for Playwright-based verification without warning that authentication artifacts may persist on disk. Persisted session state can be reused by other local users, tools, or malware to access the linked Feishu account, especially on shared machines or poorly secured environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents automatic upload of local image files to Feishu servers, but it does not clearly warn that selecting a local path causes the file contents to be transmitted to an external service. In an agent skill context, this is security-relevant because users may include sensitive local files by path without understanding the exfiltration boundary, especially when the workflow is framed as a normal Markdown conversion step.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill selects between tenant and user tokens based on broad title keywords like “用户”, “个人”, or “我的”. This can easily be triggered by ordinary document titles, causing the workflow to use a more privileged or differently scoped authentication mode than the user explicitly intended, which may change document ownership, placement, and permission behavior in security-sensitive ways. In this skill’s context, token mode directly affects who owns the document and whether permission-transfer steps occur, so heuristic misclassification is operationally and security relevant rather than merely a usability issue.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script automatically launches an OAuth authorization flow when no valid token is present, without first obtaining explicit user confirmation. This is dangerous because users may not realize the skill is initiating account-linking behavior or granting broader access than they intended.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The workflow proceeds to transfer document ownership automatically in tenant-token mode once a collaborator ID is configured, with no interactive warning or confirmation. Ownership transfer is a high-sensitivity action because it changes long-term control and can be difficult to reverse operationally.

VirusTotal

64/64 vendors flagged this skill as clean.