feishu-docs-cli@1.8.0: AI-agent control-surface risk

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically places a behavior-bearing skill file in AI-agent skill directories. That file instructs agents to route Feishu and Lark document operations through this package's CLI.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install, including dependency installation, runs postinstall.

Impact

An unconsented install changes future agent tool-selection behavior in the user's home directory.

Mechanism

Automatic mutation of AI-agent skill directories.

Policy narrative

The package's npm postinstall hook loads the skill synchronizer. It copies a packaged instruction file into the user's Claude and generic agent skill directories, creating or replacing agent behavior without an explicit command. The copied instructions make the package CLI the preferred interface for a broad category of document tasks.

AI rationale

This is an automatic install-time write to foreign AI-agent control surfaces, not an explicit user setup action. The postinstall chain and the behavior-bearing copied skill satisfy the install-hook abuse policy.

Evidence

package.jsonscripts/postinstall.mjsdist/utils/skill-sync.jsskills/feishu-docs/SKILL.md~/.claude/skills/feishu-docs/SKILL.md~/.agents/skills/feishu-docs/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest automatically runs a postinstall hook.
The hook imports and runs the skill synchronizer during npm installation.
The synchronizer writes packaged instructions into Claude and generic agent skill directories.
The packaged skill directs AI agents to use this CLI for Feishu and Lark document tasks.

Evidence against

The observed network code targets Feishu/Lark OAuth and API endpoints for the stated CLI service.
No unrelated credential-exfiltration endpoint was found in the inspected code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 325 KB of source, external domains: 127.0.0.1, accounts.larksuite.com, open.feishu.cn, open.larksuite.com, registry.npmjs.org

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = feishu-docs-cli@1.6.0 matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.6.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

10import { existsSync } from "node:fs"; L11: import { execFile } from "node:child_process"; L12: import { CliError } from "./utils/errors.js";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L10

dist/utils/version.jsView file

15export function getLocalVersion() { L16: const require = createRequire(import.meta.url); L17: const pkg = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/version.jsView on unpkg · L15

dist/auth.js#virtual:normalized:round1View file

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js -> dist/commands/authorize.js -> dist/auth.js L183: const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

dist/utils/skill-sync.jsView file

24{ L25: parentDir: join(home, ".claude", "skills"), L26: filePath: join(home, ".claude", "skills", "feishu-docs", "SKILL.md"), L27: canonical: true, ... L29: { L30: parentDir: join(home, ".agents", "skills"), L31: filePath: join(home, ".agents", "skills", "feishu-docs", "SKILL.md"), L32: canonical: false, ... L81: } L82: await mkdir(dirname(target.filePath), { recursive: true }); L83: await writeFile(target.filePath, source, "utf-8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/utils/skill-sync.jsView on unpkg · L24

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { readfile, writefile, mkdir, stat } from "node:fs/promises"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const skill_source = resolve(__dirname, "../../skills/feishu-docs/skill.md"); const disable_env = "feishu_docs_no_skill_sync"; function gettargets(home) { return [ { parentdir: join(home, ".claude", "skills"), filepath: join(home, ".claude", "skills", "feishu-d

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/utils/skill-sync.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = feishu-docs-cli@1.6.0 matchedIdentity = npm:ZmVpc2h1LWRvY3MtY2xp:1.6.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth.jsView on unpkg

10import { existsSync } from "node:fs"; L11: import { execFile } from "node:child_process"; L12: import { CliError } from "./utils/errors.js";

High

Child Process

Package source references child process execution.

dist/auth.jsView on unpkg · L10

dist/utils/version.jsView file

15export function getLocalVersion() { L16: const require = createRequire(import.meta.url); L17: const pkg = require("../../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/version.jsView on unpkg · L15

dist/auth.js#virtual:normalized:round1View file

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

183Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cli.js -> dist/commands/authorize.js -> dist/auth.js L183: const hasTenantCreds = envAppId && envAppSecret; L184: // Only skip stale user token when it"s expired, has no refresh_token,\n // AND tenant credentials are available. In this case, fall through to\n // tenant mode (crea... L185: "&": "&",

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/auth.js#virtual:normalized:round1View on unpkg · L183

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/auth.js#virtual:normalized:round1View on unpkg

dist/utils/skill-sync.jsView file

24{ L25: parentDir: join(home, ".claude", "skills"), L26: filePath: join(home, ".claude", "skills", "feishu-docs", "SKILL.md"), L27: canonical: true, ... L29: { L30: parentDir: join(home, ".agents", "skills"), L31: filePath: join(home, ".agents", "skills", "feishu-docs", "SKILL.md"), L32: canonical: false, ... L81: } L82: await mkdir(dirname(target.filePath), { recursive: true }); L83: await writeFile(target.filePath, source, "utf-8");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/utils/skill-sync.jsView on unpkg · L24

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { readfile, writefile, mkdir, stat } from "node:fs/promises"; import { homedir } from "node:os"; import { dirname, join, resolve } from "node:path"; import { fileurltopath } from "node:url"; const __dirname = dirname(fileurltopath(import.meta.url)); const skill_source = resolve(__dirname, "../../skills/feishu-docs/skill.md"); const disable_env = "feishu_docs_no_skill_sync"; function gettargets(home) { return [ { parentdir: join(home, ".claude", "skills"), filepath: join(home, ".claude", "skills", "feishu-d

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/utils/skill-sync.jsView on unpkg

Findings

2 Critical8 High5 Medium5 Low

CriticalAi Agent Control Hijackdist/utils/skill-sync.js

CriticalPrevious Version Dangerous Deltadist/auth.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/auth.js

HighShell

HighSame File Env Network Executiondist/auth.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighTrigger Reachable External Ai Agent Control Surface Mutationdist/utils/skill-sync.js

HighTrigger Reachable Command Output Exfiltrationdist/auth.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/auth.js#virtual:normalized:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/utils/version.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code