Security audit

feishu-image-sender

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Feishu image-sharing purpose is clear, but the bundled implementation has unsafe flaws that could expose screenshots, run code from a crafted filename, or delete an original image file.

Review carefully before installing. Only use it when you are comfortable sending the selected image or screen contents to Feishu, avoid full-screen capture around secrets or private data, and do not process untrusted image filenames until the python -c interpolation and compression cleanup bugs are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: improved/utils.py:108
Finding: Arbitrary Python Code Execution Through a Crafted Image Filename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: improved/utils.py:91
Finding: Original User File Deleted When Image Compression Fails
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: improved/utils.py:50
Finding: Predictable Temporary Files Permit Symlink and Race Attacks
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: improved/SKILL.md:484
Finding: Unpinned Pillow Dependency Installation
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` - Install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Use a dedicated virtual environment rather than modifying the global Python installation. - Document the expected package index and avoid untrusted mirrors. - Periodically review and intentionally update the pinned version after security testing. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises full-screen capture, region capture, and local image upload to Feishu, but it does not warn users that screenshots and local files may contain sensitive information such as credentials, internal documents, chats, or personal data. In an agent skill context, this omission increases the risk of inadvertent data exfiltration because users may trigger the feature through natural-language commands without appreciating that captured content will be transmitted off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises screenshot and local image sending but does not prominently warn that captured screen contents and local files will be transmitted to Feishu, which may include secrets, personal data, or internal business information. Because the workflow is framed as routine and convenient, users may trigger external disclosure without recognizing the privacy and data-handling consequences.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill's core features normalize taking screenshots or selecting screen regions and forwarding them to Feishu, which is effectively a built-in channel for transmitting whatever sensitive information is visible on screen. Although the feature appears productivity-oriented rather than overtly malicious, the skill context makes accidental disclosure plausible and routine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The full-screen capture workflow takes a screenshot of the entire display and immediately sends it, but it does not warn that full-screen captures can include passwords, tokens, chats, email, customer data, or other sensitive windows visible at capture time. In a security context, this omission materially increases the risk of unintentional data exfiltration to an external messaging platform.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This documented process captures a system screenshot, copies it into a workspace, and sends it to Feishu as a standard flow, creating a direct path from potentially sensitive screen contents to an external recipient. In context, this is more dangerous because it is operational guidance, not just a conceptual mention, and it encourages immediate transmission without review.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script examples automate screenshot capture and subsequent upload to Feishu, lowering friction for repeated disclosure of screen contents and making accidental leakage more likely. Automation increases risk because users may invoke the helper casually, while the captured image can contain credentials, internal dashboards, personal messages, or other confidential data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill promotes screenshot capture and transmission to Feishu without a clear, prominent warning that screenshots may contain sensitive on-screen data such as credentials, personal data, internal documents, or chat content. In a skill that performs external sharing, the absence of an explicit privacy warning materially increases the risk of accidental data disclosure by users.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly instructs users to take screenshots or send local images and have them automatically forwarded to Feishu. Because screenshots and local images often contain sensitive or regulated information, this creates a straightforward exfiltration path to an external system with little friction or review.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The implementation copies images into a workspace directory and then sends them to Feishu, preserving a second local copy while also transmitting the file externally. This increases exposure by creating both an outbound data-leak channel and residual local artifacts that may contain confidential visual data beyond the user's original intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The main function's usage string says the script should be invoked as python3 utils.py process_image <input_path> <base_name>, which implies four argv entries including a subcommand. However, the code actually requires exactly three argv entries and then treats sys.argv[1] as the input path, not as the literal process_image. This is an active contradiction between the inline documentation and the code's real behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module description and all user-facing messages are written only in Chinese, indicating a fixed language experience with no option to select another language. The policy explicitly calls for flagging language or locale constraints when they are forced without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · improved/feishu-image-send.py (reported line 54)May include surrounding context.
python
def check_dependencies(): """检查依赖""" # 检查python3 if not subprocess.run(['which', 'python3'], capture_output=True).returncode == 0: print("❌ python3 命令不可用") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · improved/feishu-image-send.py (reported line 102)May include surrounding context.
python
print(f"📏 文件大小: {file_size_mb:.2f} MB") # 调用工具函数处理图片 result = subprocess.run([ 'python3', str(UTILS_FILE), 'process_image', str(image_path), f"{name}_{int(timestamp)}" ], capture_output=True, text=True)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script captures a user-selected screenshot and then automatically processes and sends it to Feishu, but the visible prompts only describe taking the screenshot and do not clearly warn that the image will be transmitted off-host. This creates a real privacy and data-leak risk because users may believe they are only saving or locally processing an image, and may inadvertently share sensitive on-screen information.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script is presented as a screenshot utility, but it also forwards the captured image to Feishu through a Python helper. That mismatch reduces informed user consent and can lead to unintended disclosure of sensitive on-screen data, especially because screenshots often contain credentials, messages, or internal documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script captures the entire screen and immediately processes/sends the image without any confirmation, review step, or warning about sensitive content. In an agent skill context, this is particularly dangerous because automated execution can exfiltrate confidential information from the user's desktop without meaningful awareness at the moment of capture.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's user-facing strings, usage text, and status/error messages are entirely in Chinese, which imposes a specific language on users. There is no opt-in, fallback language, or documentation in this file indicating that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This utility does more than local image processing: it copies files into a workspace and transmits them through an external messaging channel. In a generic utility module, hidden exfiltration behavior increases the chance that sensitive images are sent off-host without the caller clearly intending or understanding that side effect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The function silently copies images into a persistent workspace and sends them to Feishu without any user-facing confirmation, consent, or clear audit boundary. In skill context, this makes accidental disclosure of screenshots, personal photos, or other sensitive images more dangerous because exfiltration is built into a helper routine rather than a clearly named send/export action.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 94% confidence
Finding: The code launches a Python subprocess and builds the -c program string with workspace_path interpolated directly into Python source code. If a filename contains quotes or Python syntax, an attacker can break out of the string literal and execute arbitrary code in the child interpreter when the image is sent.
Content: Scanner excerpt · improved/utils.py (reported line 116)May include surrounding context.
python
shutil.copy2(image_path, workspace_path) # 发送到飞书 result = subprocess.run([ sys.executable, "-c", f"from message import message; message(action='send', media='{workspace_path}')" ], capture_output=True, text=True)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The natural-language content in this file appears to assume a single language without offering an alternative or stating that the skill is intended only for Chinese-speaking users. This can constitute a language policy concern when no user choice or justification is documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The skill documentation and all user-facing examples are presented only in Chinese, which can constitute a language/locale policy issue when no user opt-in or stated regional limitation is provided. There is no indication that this skill is intentionally restricted to a Chinese-speaking environment or that alternate language support is unavailable by design.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script silently copies the user-supplied image into a persistent workspace directory before sending it. This creates an unintended data-retention side effect: sensitive images may remain on disk in another location without the user's awareness, increasing the chance of later disclosure through local access, backups, or other tooling that reads the workspace.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The inline comment at L40 says '发送原图版' ('send original image version'), but the code actually sends WORKSPACE_PATH, which is a copied file created at L24 under a workspace directory rather than the original path. This is a documentation-to-behavior contradiction, even if the copied content may be identical.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's natural-language comments are entirely in Chinese, which imposes a specific language on maintainers or operators without any opt-in or documented locale justification. Under the stated policy, forcing a specific language can be a language/locale policy violation when no choice or rationale is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.