Skill Trust Decision
fork-latte-skill
功能合法的报名收集工具，但存在权限声明与实际能力不符（文档未声明shell权限但实际使用）、硬编码开发者路径和API Key等文档透明度问题。
Most direct threat evidence
Why this conclusion was reached
1/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
6 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
权限声明与实际不符 +15
SKILL.md未声明shell权限，但步骤0.5和步骤3-4使用PowerShell exec发送HTTP请求和Start-Process启动进程
硬编码开发者路径 +8
步骤0.5硬编码了C:\Users\聿\...路径，暴露开发者用户名和目录结构
硬编码API Key +5
内置默认api_key=jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68，虽非敏感凭证但应移除默认配置
lark-cli外部命令执行 +5
server.js使用spawn('lark-cli', args, {shell:true})执行外部CLI工具
Most important evidence
Medium Doc Mismatch
shell权限未声明但实际使用
SKILL.md未在metadata.requires中声明shell/exec权限，但步骤0.5使用PowerShell的Invoke-RestMethod发送HTTP请求、Start-Process启动进程、Get-NetTCPConnection检查端口。这是CLI工具的正常用法，但文档透明度不足。
SKILL.md:37 在metadata.requires中添加bins声明或说明使用shell工具执行HTTP请求和进程管理
Medium Sensitive Access
硬编码开发者路径暴露用户信息
步骤0.5中硬编码了C:\Users\聿\...路径，暴露了开发者用户名聿和目录结构。虽注释解释是为了解决中文路径编码问题，但此路径不应出现在公开发布的skill中。
SKILL.md:43 移除硬编码路径，改用相对路径或环境变量检测
Low Credential Theft
内置默认API Key
config.json和SKILL.md中内置了默认api_key=jcc_signup_a7K9mP2xQ8vL4nR6wT1yZ68，虽为relay服务认证key非飞书凭证，但不应有默认值。
relay-server/config.json:1 移除默认API Key，要求用户必须配置
Low RCE
server.js执行外部lark-cli命令
server.js使用spawn('lark-cli', args, {shell:true})执行外部CLI工具进行飞书表格操作。这是feishu_api模式的功能前置条件，但对于无lark-cli环境的用户可能意外触发错误。
relay-server/server.js:69 确保在MODE=lark_cli时才调用lark-cli，当前代码已正确隔离
Declared capability vs actual capability
Shell Block
Declared NONE
→ Inferred WRITE
SKILL.md:1 (metadata未声明) vs SKILL.md:37-45 (PowerShell exec使用) Filesystem Pass
Declared READ
→ Inferred READ
SKILL.md读取config.json Network Pass
Declared READ
→ Inferred WRITE
SKILL.md声明POST但实际只发往预配置endpoint Suspicious artifacts and egress
Medium External URL
https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue relay-server/README.md:3
Medium External URL
https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green relay-server/README.md:3
Medium External URL
https://img.shields.io/badge/api-REST-orange relay-server/README.md:3
Medium External URL
https://open.feishu.cn relay-server/README.md:28
Medium External URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal relay-server/README.md:67
Medium External URL
https://open.feishu.cn/open-apis/bitable/v1/apps/ relay-server/README.md:74
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| node:http | built-in | Node.js标准库 | No | 无外部依赖 |
| node:fs/promises | built-in | Node.js标准库 | No | 无外部依赖 |
| node:child_process | built-in | Node.js标准库 | No | 无外部依赖 |
File composition
8 files · 695 lines
Markdown 3 files · 418 linesJavaScript 1 files · 239 linesOther 1 files · 28 linesJSON 3 files · 10 lines
Files of concern · 4
relay-server/config.json 内置默认API Key
relay-server/server.js server.js执行外部lark-cli命令
SKILL.md shell权限未声明但实际使用 · 硬编码开发者路径暴露用户信息
relay-server/README.md https://img.shields.io/badge/mode-lark__cli%20%7C%20feishu__api-blue · https://img.shields.io/badge/stack-Node.js%20%2B%20Feishu%20Bitable-green · https://img.shields.io/badge/api-REST-orange · https://open.feishu.cn · https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal · https://open.feishu.cn/open-apis/bitable/v1/apps/
Other files · README.md · run-relay.ps1 · package.json · config.example.json
Security positives
飞书凭证分离设计合理：客户端不接触飞书token，只与本地relay通信
支持覆盖/新增两种模式，逻辑完整
使用API Key保护relay服务端防滥用
package.json无第三方依赖，仅使用Node.js标准库
.env被gitignore保护，敏感配置不进仓库