Simple Management of Product Documents

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent Feishu document-management guide, but it includes live-looking credentials and encourages storing secrets in collaborative documents.

Review before installing. Do not use this package as-is in a shared environment: revoke and rotate the exposed Feishu App Secret, access token, and refresh token, remove personal/account data, and replace all credentials with placeholders. Treat Feishu configuration documents as non-secret documentation only; store actual tokens, API keys, passwords, and deployment secrets in a dedicated secret manager.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/feishu-api-setup.md:335
• Finding: Hardcoded Feishu Application and User Credentials## Vulnerability Details **File Location**: `references/feishu-api-setup.md`, lines 335–341 **Additional Occurrence**: `references/feishu-api-setup.md`, lines 165–174 **Vulnerability Type**: Plaintext hardcoded secrets and sensitive account data **Risk Level**: High The document contains a live-looking Feishu App Secret, user access token, refresh token, application identifier, and user identifier: ```markdown - **App ID**: `cli_a948e3ca9fb99bcc` - **App Secret**: `1UakAZzxnrcp17qhH9R1FcRKOYJTp28S` ``` ```markdown - **user_access_token**: `u-7YAewM3Y12bVmJ9rIPQGlBkl1.ugg5WXOwEaFQA02ASb` - **refresh_token**: `ur-71UTe8a0N3QWCQLyFIR4L7kl1YYgg5gjMgEaZMM02BCe` - **open_id**: `ou_cbcc27fa7979db72b850c0cf97c03ca6` ``` Lines 165–174 also repeat the access token and refresh token in an API response example and disclose associated personal account data. ### Technical Analysis Secrets committed to a distributable Skill package are available to every person or automated system that can download, inspect, cache, or fork the package. An App Secret is an application authentication credential. A user access token grants user-scoped API access, while a refresh token may allow an attacker to obtain replacement access tokens without repeating interactive authorization. Credential validity was not tested during this static audit. However, the values are concrete, internally consistent with the documented application, and presented as actual project credentials rather than unmistakable placeholders. Even if the access token has expired, the App Secret or refresh token may remain useful until revoked or expired. The same document identifies granted document, drive, and wiki permissions. Consequently, any successful use of the exposed credentials would operate within the scopes and resources authorized for the application and affected user. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill package. 2. The a ...[truncated 1330 chars]
• Remediation: ## Remediation Suggestions 1. Immediately revoke the exposed user access token and refresh token. 2. Rotate the exposed App Secret and investigate Feishu audit logs for unauthorized token refreshes or API activity. 3. Remove all real credentials, account identifiers, phone numbers, and other personal data from the current files and repository history. 4. Replace concrete values with unmistakable placeholders such as `${FEISHU_APP_SECRET}`, `${FEISHU_ACCESS_TOKEN}`, and `${FEISHU_REFRESH_TOKEN}`. 5. Store application secrets and OAuth tokens in an approved secret manager, not in source files or collaborative documents. 6. Restrict secret access by service identity and environment, and apply the minimum necessary Feishu scopes. 7. Enable automated secret scanning in pre-commit hooks and CI pipelines, including detection for Feishu token prefixes and high-entropy values. 8. Add a credential-rotation procedure and document token revocation, expiration, and incident-response requirements.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Workflow Directs Users to Store Secrets in Collaborative Documents## Vulnerability Details **File Location**: `SKILL.md`, lines 29–31 **Vulnerability Type**: Unsafe storage of API keys and deployment secrets **Risk Level**: Medium The prescribed project structure defines a continuously maintained configuration document containing secret-bearing material: ```markdown │ └── (Ongoing) API keys, env variables, deployment configs ``` ### Technical Analysis API keys and environment variables commonly contain authentication credentials, database passwords, signing keys, webhook secrets, and infrastructure tokens. Directing an Agent or user to place these values in a Feishu document moves secrets into a collaborative content system where access may be broader than access to a dedicated secret vault. The instruction does not require redaction, encryption, least-privilege sharing, access reviews, audit monitoring, or references to a secret manager. Because the document is described as ongoing, it may accumulate current and historical credentials over time. Normal collaboration features such as sharing, copying, exporting, indexing, and integration access can enlarge the exposure surface. ### Attack Path 1. A user or Agent follows the documented project setup workflow. 2. API keys, environment-variable values, or deployment credentials are entered into the Feishu Configuration Records document. 3. The document is shared with collaborators, inherited by a broadly accessible knowledge base, exported, or accessed through an authorized integration. 4. An attacker compromises a collaborator account, obtains an improperly shared link, or abuses an integration with document access. 5. The attacker extracts the stored credentials. 6. The attacker authenticates to the corresponding APIs, databases, cloud services, deployment platforms, or other project infrastructure within the privileges assigned to those credentials. ### Impact Assessment The precise impact depends on the secrets entered into the ...[truncated 513 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly prohibit storing secret values, tokens, passwords, private keys, or sensitive environment-variable contents in Feishu documents. 2. Store secrets in a dedicated secret-management service with encryption, access controls, audit logging, and rotation support. 3. Limit the configuration document to non-sensitive metadata, such as variable names, descriptions, owners, rotation dates, and secret-manager reference paths. 4. Provide a safe template that separates public configuration from confidential credentials and includes examples using placeholders only. 5. Apply least-privilege access controls to configuration documentation and review membership and shared links regularly. 6. Establish automatic credential rotation and incident-response procedures for any secret accidentally pasted into a document. 7. Use data-loss-prevention or content-scanning controls to detect token formats, private keys, passwords, and other secrets in collaborative documents.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

**原因**：API 调用方式错误
**解决**：将 `app_id` 和 `app_secret` 放在请求 body 中，不要用 Basic Auth

### 7.3 错误码 99991663 - Invalid access token

**原因**：token 过期或格式错误
**解决**：重新获取 user_access_token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The file explicitly advises not to hardcode secrets, then later embeds real secrets and tokens in the same document. This contradiction increases the likelihood that operators will trust the file as safe guidance while unknowingly distributing active credentials, making accidental compromise and lateral misuse more likely.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The document includes what appear to be real Feishu App credentials, a user access token, and a refresh token tied to a named user. Exposing live secrets in a reference file enables unauthorized API access, token reuse, document access/modification, and possible persistence via refresh-token rotation, which is far beyond the skill’s legitimate documentation purpose.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The document publicly displays a real App Secret, user_access_token, and refresh_token without any warning that they are sensitive or must be revoked. Anyone with file access can reuse these credentials to impersonate the user/application, access or alter Feishu documents, and potentially maintain access using the refresh token.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs users to maintain a 'Configuration Records' document containing API keys, environment variables, and deployment configuration, but provides no safeguards for secret handling. In the context of a shared Feishu knowledge base, this can lead to credential exposure, privilege abuse, and downstream compromise of connected systems if the document is accessed by unintended users or synced/exported insecurely.

External Transmission

Medium

• Category: Data Exfiltration

Content

使用以下 API 调用换取 token：

```bash
curl -X POST "https://open.feishu.cn/open-apis/authen/v1/access_token" \
  -H "Content-Type: application/json" \
  -d '{
    "app_id": "cli_你的AppID",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Use Feishu API to create a new knowledge base:

```bash
curl -X POST "https://open.feishu.cn/open-apis/wiki/v2/spaces" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The example instructs users to create remote Feishu resources and later examples write or append content, but it does so without any explicit warning that these actions modify live remote state. In a documentation-management skill, that omission can cause accidental creation or modification of production knowledge-base content if a user copies the examples directly.

Static analysis

No suspicious patterns detected.