Security audit

feishu-doc-editor

Security checks for vulnerabilities and agentic risk

Overview

This is a Feishu document API guide, but it asks users to set up persistent edit/delete access and includes unsafe token-handling examples that need review before use.

Install only if you are comfortable granting a Feishu self-built app document read/write permissions. Use least-privilege scopes, avoid enabling Bot capability unless needed, do not paste real app secrets or tokens into shared terminals or scripts, avoid curl verbose logging with Authorization headers, confirm targets before edits or deletes, and revoke app/document permissions when finished.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: references/common-errors.md:506
Finding: Bearer Token Exposure Through Verbose HTTP Diagnostics
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/common-errors.md:539
Finding: Unsafe Application Secret Storage and Access Token Logging in Diagnostic Script
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:14
Finding: Mandatory Bot Capability Exceeds the Skill's Document-Editing Requirements
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (22)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
md
**Publish app**: Submit version and publish, ensuring the app coverage includes target users/departments. ### 2. Get Access Token Call the self-built app get tenant_access_token interface:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
**Publish app**: Submit version and publish, ensuring the app coverage includes target users/departments. ### 2. Get Access Token Call the self-built app get tenant_access_token interface:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-guide.md (reported line 177)May include surrounding context.
接口：

text
DELETE /docx/v1/documents/{document_id}/blocks/{block_id}

响应示例：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs an agent to read and modify Feishu documents but provides no user-facing warning, confirmation step, or safety boundaries around accessing potentially sensitive content or making destructive edits. In an agent context, this increases the risk of unauthorized data access, unintended exfiltration through API calls, or accidental document modification without explicit user awareness.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
Call the self-built app get tenant_access_token interface:

bash
curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{"app_id": "your_app_id", "app_secret": "your_app_secret"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The guide instructs users to obtain and use app credentials and tenant access tokens, then perform API calls that read and modify document contents, but it does not include any privacy or credential-handling warning. In markdown documentation, operations involving sensitive tokens and access to user data should disclose those risks clearly.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-guide.md (reported line 11)May include surrounding context.
获取 token：

bash
curl -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \ -H "Content-Type: application/json" \ -d '{"app_id": "your_app_id", "app_secret": "your_app_secret"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file documents a block deletion endpoint and later provides a direct delete workflow, but it does not warn users that the operation removes document content and may be irreversible. For markdown files, destructive behaviors that can affect user data should be accompanied by clear warnings.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-guide.md (reported line 283)May include surrounding context.
md
# 假设 document_id = "ABC123" # 3. 写入内容 curl -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/ABC123/blocks/ABC123/children" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-guide.md (reported line 311)May include surrounding context.
md
-H "Authorization: Bearer $TOKEN" | jq '.data.items[0].block_id' # 2. 更新块内容 curl -X PATCH "https://open.feishu.cn/open-apis/docx/v1/documents/ABC123/blocks/BLOCK_ID" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/common-errors.md (reported line 45)May include surrounding context.
bash
# ❌ 错误示例 curl -X POST "https://open.feishu.cn/open-apis/..." \ -H "Content-Type: application/json" \ -d '{"..."}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The verbose curl debugging example encourages inspecting Authorization headers directly, which can leak bearer tokens into terminal scrollback, CI logs, shell history capture, and support artifacts. Because bearer tokens grant API access, disclosure can enable unauthorized document access or modification until expiry.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/common-errors.md (reported line 91)May include surrounding context.
bash
# 1. 重新获取 token curl -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d '{ "app_id": "your_app_id",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide includes concrete examples that use app credentials and tokens in shell scripts and prints token material to stdout. In a troubleshooting document for an agent skill, this normalizes unsafe secret handling and increases the chance operators will expose credentials in terminals, logs, screenshots, or shared runbooks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/common-errors.md (reported line 406)May include surrounding context.
md
# - text.elements[0].text_run.content # 3. 使用 jq 格式化 JSON curl -X POST "URL" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d @request.json | jq .

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/common-errors.md (reported line 431)May include surrounding context.
md
} EOF curl -X POST "URL" \ -H "Authorization: Bearer {token}" \ -H "Content-Type: application/json" \ -d @request.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: Although the transmission is to a legitimate Feishu auth endpoint, the surrounding test script embeds app credentials inline and captures token responses in shell variables for subsequent output. In practice this can leak secrets via process inspection, shell history, pasted scripts, CI logs, or shared debugging sessions.
Content: Scanner excerpt · references/common-errors.md (reported line 548)May include surrounding context.
md
# 1. 获取 token echo "获取 token..." TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\": \"$APP_ID\", \"app_secret\": \"$APP_SECRET\"}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The example combines authenticated outbound requests with error logging that records request bodies and responses, creating a realistic path for sensitive document data or tokens to be written to local logs. Even if the destination is legitimate, the logging pattern materially increases exposure of transmitted secrets and content.
Content: Scanner excerpt · references/common-errors.md (reported line 593)May include surrounding context.
md
} # 使用示例 curl -s -X POST "URL" -H "Authorization: Bearer {token}" -d '{"..."}' || { log_error "API 调用失败: URL" log_error "请求体: {...}" log_error "响应: $(curl -s ...)"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/permission-setup.md (reported line 144)May include surrounding context.
md
APP_OPEN_ID="ou_xxxxxxxxx" # 调用添加协作者 API curl -X POST "https://open.feishu.cn/open-apis/docx/v1/documents/{document_id}/permissions/permission" \ -H "Authorization: Bearer {tenant_access_token}" \ -H "Content-Type: application/json" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide shows how to request a tenant_access_token using app_id and app_secret, but it does not warn readers to treat those values and the returned token as secrets. In practice, users often paste such commands into shared terminals, CI logs, screenshots, or documentation, which can expose credentials that allow unauthorized API access to Feishu resources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The skill content appears to require Chinese comprehension and does not offer an alternative language or note that the material is intentionally Chinese-only. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This guide presents all instructions in Chinese and does not indicate that the language is optional or justified by a region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.