Simple Management of Product Documents

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent Feishu document-management guide, but it includes live-looking credentials and encourages storing secrets in collaborative documents.

Review before installing. Do not use this package as-is in a shared environment: revoke and rotate the exposed Feishu App Secret, access token, and refresh token, remove personal/account data, and replace all credentials with placeholders. Treat Feishu configuration documents as non-secret documentation only; store actual tokens, API keys, passwords, and deployment secrets in a dedicated secret manager.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/feishu-api-setup.md:335

Finding

Hardcoded Feishu Application and User Credentials

Content

View full analysis

Vulnerability Details

File Location: references/feishu-api-setup.md, lines 335–341
Additional Occurrence: references/feishu-api-setup.md, lines 165–174
Vulnerability Type: Plaintext hardcoded secrets and sensitive account data
Risk Level: High

The document contains a live-looking Feishu App Secret, user access token, refresh token, application identifier, and user identifier:

markdown

- **App ID**: `cli_a948e3ca9fb99bcc`
- **App Secret**: `1UakAZzxnrcp17qhH9R1FcRKOYJTp28S`

markdown

- **user_access_token**: `u-7YAewM3Y12bVmJ9rIPQGlBkl1.ugg5WXOwEaFQA02ASb`
- **refresh_token**: `ur-71UTe8a0N3QWCQLyFIR4L7kl1YYgg5gjMgEaZMM02BCe`
- **open_id**: `ou_cbcc27fa7979db72b850c0cf97c03ca6`

Lines 165–174 also repeat the access token and refresh token in an API response example and disclose associated personal account data.

Technical Analysis

Secrets committed to a distributable Skill package are available to every person or automated system that can download, inspect, cache, or fork the package. An App Secret is an application authentication credential. A user access token grants user-scoped API access, while a refresh token may allow an attacker to obtain replacement access tokens without repeating interactive authorization.

Credential validity was not tested during this static audit. However, the values are concrete, internally consistent with the documented application, and presented as actual project credentials rather than unmistakable placeholders. Even if the access token has expired, the App Secret or refresh token may remain useful until revoked or expired.

The same document identifies granted document, drive, and wiki permissions. Consequently, any successful use of the exposed credentials would operate within the scopes and resources authorized for the application and affected user.

Attack Path

1. An attacker downloads or otherwise obtains the Skill package.
2. The a ...[truncated 1330 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke the exposed user access token and refresh token.
2. Rotate the exposed App Secret and investigate Feishu audit logs for unauthorized token refreshes or API activity.
3. Remove all real credentials, account identifiers, phone numbers, and other personal data from the current files and repository history.
4. Replace concrete values with unmistakable placeholders such as ${FEISHU_APP_SECRET}, ${FEISHU_ACCESS_TOKEN}, and ${FEISHU_REFRESH_TOKEN}.
5. Store application secrets and OAuth tokens in an approved secret manager, not in source files or collaborative documents.
6. Restrict secret access by service identity and environment, and apply the minimum necessary Feishu scopes.
7. Enable automated secret scanning in pre-commit hooks and CI pipelines, including detection for Feishu token prefixes and high-entropy values.
8. Add a credential-rotation procedure and document token revocation, expiration, and incident-response requirements.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Workflow Directs Users to Store Secrets in Collaborative Documents

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–31
Vulnerability Type: Unsafe storage of API keys and deployment secrets
Risk Level: Medium

The prescribed project structure defines a continuously maintained configuration document containing secret-bearing material:

markdown

│   └── (Ongoing) API keys, env variables, deployment configs

Technical Analysis

API keys and environment variables commonly contain authentication credentials, database passwords, signing keys, webhook secrets, and infrastructure tokens. Directing an Agent or user to place these values in a Feishu document moves secrets into a collaborative content system where access may be broader than access to a dedicated secret vault.

The instruction does not require redaction, encryption, least-privilege sharing, access reviews, audit monitoring, or references to a secret manager. Because the document is described as ongoing, it may accumulate current and historical credentials over time. Normal collaboration features such as sharing, copying, exporting, indexing, and integration access can enlarge the exposure surface.

Attack Path

1. A user or Agent follows the documented project setup workflow.
2. API keys, environment-variable values, or deployment credentials are entered into the Feishu Configuration Records document.
3. The document is shared with collaborators, inherited by a broadly accessible knowledge base, exported, or accessed through an authorized integration.
4. An attacker compromises a collaborator account, obtains an improperly shared link, or abuses an integration with document access.
5. The attacker extracts the stored credentials.
6. The attacker authenticates to the corresponding APIs, databases, cloud services, deployment platforms, or other project infrastructure within the privileges assigned to those credentials.

Impact Assessment

The precise impact depends on the secrets entered into the ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly prohibit storing secret values, tokens, passwords, private keys, or sensitive environment-variable contents in Feishu documents.
2. Store secrets in a dedicated secret-management service with encryption, access controls, audit logging, and rotation support.
3. Limit the configuration document to non-sensitive metadata, such as variable names, descriptions, owners, rotation dates, and secret-manager reference paths.
4. Provide a safe template that separates public configuration from confidential credentials and includes examples using placeholders only.
5. Apply least-privilege access controls to configuration documentation and review membership and shared links regularly.
6. Establish automatic credential rotation and incident-response procedures for any secret accidentally pasted into a document.
7. Use data-loss-prevention or content-scanning controls to detect token formats, private keys, passwords, and other secrets in collaborative documents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/feishu-api-setup.md (reported line 277)May include surrounding context.

md

**原因**：API 调用方式错误
**解决**：将 `app_id` 和 `app_secret` 放在请求 body 中，不要用 Basic Auth

### 7.3 错误码 99991663 - Invalid access token

**原因**：token 过期或格式错误
**解决**：重新获取 user_access_token

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file explicitly advises not to hardcode secrets, then later embeds real secrets and tokens in the same document. This contradiction increases the likelihood that operators will trust the file as safe guidance while unknowingly distributing active credentials, making accidental compromise and lateral misuse more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document includes what appear to be real Feishu App credentials, a user access token, and a refresh token tied to a named user. Exposing live secrets in a reference file enables unauthorized API access, token reuse, document access/modification, and possible persistence via refresh-token rotation, which is far beyond the skill’s legitimate documentation purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document publicly displays a real App Secret, user_access_token, and refresh_token without any warning that they are sensitive or must be revoked. Anyone with file access can reuse these credentials to impersonate the user/application, access or alter Feishu documents, and potentially maintain access using the refresh token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to maintain a 'Configuration Records' document containing API keys, environment variables, and deployment configuration, but provides no safeguards for secret handling. In the context of a shared Feishu knowledge base, this can lead to credential exposure, privilege abuse, and downstream compromise of connected systems if the document is accessed by unintended users or synced/exported insecurely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/feishu-api-setup.md (reported line 149)May include surrounding context.

使用以下 API 调用换取 token：

bash

curl -X POST "https://open.feishu.cn/open-apis/authen/v1/access_token" \
  -H "Content-Type: application/json" \
  -d '{
    "app_id": "cli_你的AppID",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/workflow-examples.md (reported line 10)May include surrounding context.

Use Feishu API to create a new knowledge base:

bash

curl -X POST "https://open.feishu.cn/open-apis/wiki/v2/spaces" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example instructs users to create remote Feishu resources and later examples write or append content, but it does so without any explicit warning that these actions modify live remote state. In a documentation-management skill, that omission can cause accidental creation or modification of production knowledge-base content if a user copies the examples directly.

Content

No source excerpt is available for this finding.