Feishu Bot Full Setup

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

The skill does create a Feishu bot as advertised, but it requests very broad Feishu permissions, handles app secrets in ordinary messages, and can modify the local runtime during setup.

Review before installing or running. Use an isolated machine or container, preinstall trusted dependencies yourself where possible, reduce the Feishu permission list to the minimum needed, confirm publication impact before running create, treat app_secret like a password, rotate it if exposed in chat/logs, and run cleanup after use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise FileNotFoundError(f"Chromium 不存在: {chrome_path}")

    os.makedirs(PROFILE_DIR, exist_ok=True)
    proc = subprocess.Popen(
        [
            chrome_path,
            "--headless=new",

• Confidence: 88% confidence
• Finding: The script launches a browser with remote debugging enabled and with the unsafe --no-sandbox flag. Although it binds to 127.0.0.1, local processes could potentially attach to the debugging port during execution and access the authenticated browser context, making session theft or browser control possible.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with tempfile.NamedTemporaryFile(suffix=".py", delete=False) as f:
        urllib.request.urlretrieve("https://bootstrap.pypa.io/get-pip.py", f.name)
        subprocess.check_call(
            [sys.executable, f.name, "--quiet", "--break-system-packages"]
        )

• Confidence: 98% confidence
• Finding: The script downloads get-pip.py from the network and immediately executes it, which is a classic remote code execution supply-chain risk. If the download source, TLS validation path, or network is compromised, arbitrary code can run with the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except (FileNotFoundError, subprocess.CalledProcessError):
            continue
        try:
            subprocess.call(
                pkg_mgr + libs,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

• Confidence: 84% confidence
• Finding: The script can invoke yum/dnf/apt-get to install system libraries automatically, which exceeds the narrow expectation of creating a bot and modifies the host system state. In an agent-skill context, unexpected package installation is risky because it grants the skill the ability to alter the runtime environment and potentially pull unpinned software from network repositories.

Tainted flow: 'QR_PNG_PATH' from os.environ.get (line 90, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

qr.make(fit=True)
        img = qr.make_image(fill_color="black", back_color="white")
        img = img.convert("RGB")
        with open(QR_PNG_PATH, "wb") as f:
            img.save(f)
        _status("login", f"已写入登录二维码 PNG: {QR_PNG_PATH}")
    except Exception as e:

• Confidence: 86% confidence
• Finding: QR_PNG_PATH is derived from an environment variable and used directly in a file write, allowing an external caller to redirect output to an arbitrary writable filesystem path. In an automated agent environment this can overwrite unexpected files, clobber application data, or place sensitive login artifacts in insecure locations.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The skill not only creates a Feishu bot but also sends the generated app secret over Feishu message to the creator account, which is a sensitive credential disclosure not clearly conveyed by the skill description. Secrets transmitted through chat are easier to leak via message retention, forwarding, compromised accounts, or logging, increasing exposure beyond the local process.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code automatically installs Python packages, browser binaries, and even system libraries, which materially exceeds a simple bot-creation workflow and expands the attack surface through supply-chain downloads and host mutation. In a skill setting, this is dangerous because users may grant bot-creation capability without expecting package management or privileged host changes.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script stores a PID in /tmp and later kills that process with SIGKILL, which can terminate a local process outside the immediate task if the PID file is stale, replaced, or reused. In a multi-user or concurrent environment, relying on a predictable pidfile in /tmp creates a process-targeting hazard and denial-of-service risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to return app_id and app_secret directly to the user without any guidance on secure handling, redaction, storage limits, or avoidance of secondary channels. Because app_secret is a credential, exposing it in ordinary chat output or logs can lead to credential compromise, unauthorized bot control, and long-lived access if the secret is later reused or not rotated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits highly sensitive values including app_secret and user identifiers over network API calls and chat messaging without clear user disclosure or minimization. In the context of credential provisioning, this unnecessarily increases exposure of secrets and creates downstream leakage risk in messaging systems and network traces.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code captures browser session cookies and CSRF tokens from an authenticated session and reuses them in direct HTTP requests. This effectively turns the skill into a session-riding automation client, which is powerful but risky because compromise of the process or local debugging channel could expose authenticated session material and enable account actions beyond user awareness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only, which allows future major or minor versions to be installed without review. This increases supply-chain and stability risk because a later compromised or vulnerable release could be pulled into the environment unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

• Confidence: 94% confidence
• Finding: Using an unpinned version range for qrcode means builds are not reproducible and may silently consume a newly published vulnerable or malicious release. In automation tooling, that can introduce avoidable supply-chain exposure during installation or deployment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0
qrcode>=7.4.2
pillow>=10.0.0

• Confidence: 97% confidence
• Finding: pillow is also specified with only a minimum version, so dependency resolution may select later releases without security review. Because Pillow processes image data and has a history of serious parser bugs, loose versioning is more dangerous here than for a low-risk utility package.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: The requirements file references pillow without an upper bound or exact version, and the package has multiple known historical advisories including denial-of-service and possible code-execution-class issues in image parsing. In a bot-creation skill that may generate or handle QR codes and images, image-processing exposure makes this more relevant because attacker-controlled image content could reach the vulnerable library if an affected version is installed.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.