Security audit

Feishu Image Sender

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with sending images to Feishu, but it needs review because it can transmit local files externally with broad activation and weak path/input safeguards.

Review before installing. Use this only when users explicitly ask to send specific images to Feishu, verify the exact file paths before upload, avoid sensitive screenshots or documents, and prefer a version that requires confirmation, restricts paths to the workspace after realpath checks, and serializes message instructions safely.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: send-image.sh:8
Finding: Workspace Path Traversal Can Expose Images Outside the Intended Directory
Content: View full analysis
Remediation: View remediation
&2 exit 1 ;; esac if [ ! -f "$IMAGE_PATH_REAL" ]; then echo "Error: selected path is not a regular file" >&2 exit 1 fi ``` If nested directories are unnecessary, additionally require: ```bash if [ "$IMAGE_NAME" != "$(basename -- "$IMAGE_NAME")" ]; then echo "Error: only a filename is permitted" >&2 exit 1 fi ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: send-image.sh:65
Finding: Unescaped Input Can Alter the Generated Messaging Instruction
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill claims to send images to Feishu, but its documented workflow also searches the local workspace for matching files. That local file enumeration is an additional capability not disclosed in the description, which weakens transparency and can cause users or orchestrators to invoke the skill without realizing it may inspect local files before exfiltrating them to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to send images and captions to Feishu but does not clearly disclose that both the image content and accompanying text are transmitted to an external third-party service. In a skill that operates on local workspace files, this omission can cause users to unintentionally exfiltrate sensitive screenshots, documents, or metadata beyond the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is designed to transmit local image files to an external messaging platform but does not instruct the agent to obtain explicit user confirmation or warn about outbound data transfer. In this context, automatic activation on image filenames makes the risk higher because innocuous mentions of local files could trigger unintended disclosure of workspace contents to Feishu.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation rule is overly broad because it triggers not only when a user explicitly asks to send images to Feishu, but also whenever a message contains common image filenames or paths. That can cause unintended invocation of a capability that transmits files to an external service, increasing the risk of accidental data exfiltration or user confusion about why content is being sent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description does not clearly warn users that activating this skill will upload image files to Feishu, which is an external platform. Without a clear disclosure, users may invoke the skill without understanding that local or referenced images could be transmitted outside the current environment, creating privacy and data-handling risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language instructions in this file are presented in Chinese, which may impose a language constraint on users. There is no indication that the skill offers an alternative language or that Chinese-only documentation is intentionally required for a region-specific use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operational instructions and examples are presented in Chinese, which can impose a language constraint on users without any stated opt-in or justification. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.