Feishu Img Send

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This skill does what it says by sending images to Feishu, but it ships reusable Feishu app credentials in plaintext and can send local files externally under that shared identity.

Do not install this version unless you trust the publisher's Feishu app identity and accept that local image paths you provide will be uploaded to Feishu. The publisher should revoke and rotate the exposed secret, remove bundled credentials, require user-supplied secure configuration, validate image inputs, and add clear confirmation before sending files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu_image.py:9
• Finding: Hard-Coded Feishu Application Credentials in Python Client<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu_image.py`, lines 9-11 **Vulnerability Type**: Hard-coded application secret **Risk Level**: High ### Vulnerable Code ```python def __init__(self, app_id=None, app_secret=None): self.app_id = app_id or "cli_a92d303bf7f9dcc8" self.app_secret = app_secret or "uvP39NArvXPjzPG2bvdZZs2SfZ231YFk" ``` ### Technical Analysis The Python client embeds a live-looking Feishu application ID and application secret directly in source code. Every person or system with access to the Skill package can recover these credentials without executing the script. The credentials are submitted to Feishu's internal tenant-token endpoint by `get_token()`. If they remain valid, an attacker can use them outside this Skill to request a tenant access token. Hard-coding the secret also prevents safe per-user configuration and makes credential rotation difficult. The network transmission itself is necessary for the declared Feishu image-sending functionality and uses an HTTPS Feishu endpoint. The security flaw is distributing a reusable secret in plaintext, not the documented API communication. ### Attack Path 1. An attacker downloads or otherwise reads the Skill package. 2. The attacker extracts the application ID and secret from `scripts/feishu_image.py`. 3. The attacker submits those credentials to Feishu's tenant access-token endpoint. 4. If the credentials remain active, Feishu returns a tenant access token. 5. The attacker invokes Feishu APIs authorized for that application, independently of the Skill and its intended interface. No local privilege escalation is required; read access to the distributed source is sufficient. ### Impact Assessment A successful attacker may obtain the Feishu application privileges associated with the exposed credentials. Based on the declared configuration, this may include uploading image resources and sending messages through the application. The precise reach depends o ...[truncated 452 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed Feishu application secret immediately; removal from the current files alone does not invalidate a copied credential. 2. Remove the application ID and secret from source code, release artifacts, examples, and version-control history. 3. Require credentials through environment variables or an approved secret manager, and terminate with a clear error when they are absent. 4. Do not provide a shared fallback secret. Use separate application credentials for development, testing, and production. 5. Restrict the Feishu application to the minimum API scopes and tenant access required to upload and send images. 6. Review Feishu token issuance, message, and image-upload logs for activity involving the exposed application. 7. Add automated secret scanning to development and release workflows to prevent recurrence. 8. Avoid logging credentials, authorization headers, or tenant access tokens, and ensure runtime secrets are available only to the process that needs them. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send.sh:4
• Finding: Hard-Coded Feishu Application Credentials in Shell Launcher<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send.sh`, lines 4-5 **Vulnerability Type**: Hard-coded application secret **Risk Level**: High ### Vulnerable Code ```bash APP_ID="cli_a92d303bf7f9dcc8" APP_SECRET="uvP39NArvXPjzPG2bvdZZs2SfZ231YFk" ``` ### Technical Analysis The shell launcher duplicates the Feishu application credentials in plaintext. Because shell scripts are distributed as readable source, the secret cannot be treated as confidential. An attacker does not need to run the launcher or intercept network traffic to recover it. The script uses the credentials to obtain a tenant access token and then calls the documented Feishu image-upload and message APIs. Those direct `curl` requests are consistent with the Skill's declared purpose and do not download or execute a remote script. In particular, the inspected launcher contains no `curl | bash` execution flow. The confirmed vulnerability is the embedded reusable credential. ### Attack Path 1. An attacker obtains read access to `scripts/send.sh`. 2. The attacker copies the embedded application ID and application secret. 3. The attacker sends an independent authentication request to Feishu's internal tenant-token endpoint. 4. If Feishu accepts the credentials, the attacker receives a tenant access token. 5. The attacker uses that token to call any API permitted by the application's granted scopes. This path bypasses the launcher's argument checks and intended image-sending workflow because the exposed credentials can be used from any external client. ### Impact Assessment The exposed secret may permit unauthorized use of the Feishu application's tenant-level capabilities. The observed workflow supports image uploads and message sending, while the exact maximum impact is governed by the application's effective Feishu scopes and tenant-side access controls. Possible impacts include unauthorized application-originated messages, unwanted resource uploads, API quota consumption, ...[truncated 170 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed application secret. 2. Delete the credential from the shell script and all repository history and published artifacts. 3. Read the values from protected environment variables or a secret-injection mechanism, for example requiring `FEISHU_APP_ID` and `FEISHU_APP_SECRET`. 4. Validate that required variables exist without printing their values, and exit safely when configuration is missing. 5. Use file permissions and runtime isolation to prevent unrelated users or processes from reading injected credentials. 6. Reduce the Feishu application's permissions to only the resource-upload and message operations needed by the Skill. 7. Audit application and tenant logs for suspicious token requests, uploads, and messages. 8. Add repository and CI secret-scanning controls and block releases containing credential-like values. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This duplicate mismatch finding identifies the same core issue: the skill understates its actual behavior by omitting embedded Feishu credentials and direct messaging to a specific open_id/user. Such discrepancies are dangerous because they prevent informed review and can conceal credential abuse or unapproved outbound communications.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This duplicate mismatch finding identifies the same core issue: the skill understates its actual behavior by omitting embedded Feishu credentials and direct messaging to a specific open_id/user. Such discrepancies are dangerous because they prevent informed review and can conceal credential abuse or unapproved outbound communications.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes a Feishu app ID and app secret directly in source code, which exposes reusable credentials to anyone with code access and enables unauthorized token minting against the Feishu tenant. In a skill whose purpose is image sending, embedding live credentials is unnecessary and materially increases the chance of account abuse, impersonation, and unauthorized API access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code uses embedded application credentials to request a tenant access token without any disclosure or user consent, allowing the skill to authenticate to Feishu automatically with developer-controlled secrets. This creates a covert trust boundary crossing: anyone running the skill may unknowingly operate under a third-party tenant context, enabling unauthorized messaging or other API actions tied to that app.

External Script Fetching

High

• Category: Supply Chain

Content

fi

# 获取token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tenant_access_token',''))")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

fi

# 上传图片
IMAGE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/images" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: multipart/form-data" \
  -F "image_type=message" \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no explicit tool scope or permissions even though its documented behavior requires both shell execution and outbound network access. This weakens user and platform awareness of what the skill can do, making it easier for the skill to perform external actions without clear consent boundaries.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documentation does not clearly warn users that local image files and recipient identifiers are transmitted to Feishu's external services. This creates a data handling and privacy risk because users may unknowingly send sensitive images or personal identifiers outside the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""获取tenant_access_token"""
        url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
        data = {"app_id": self.app_id, "app_secret": self.app_secret}
        resp = requests.post(url, json=data)
        result = resp.json()
        return result.get("tenant_access_token")

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function reads a local file path and uploads the file contents to Feishu without an explicit warning that local data will be transmitted to an external service. Although uploading an image is aligned with the skill's stated purpose, the lack of disclosure and confirmation increases the risk of accidental exfiltration of sensitive local files if the path is misused or misunderstood.

External Transmission

Medium

• Category: Data Exfiltration

Content

"content": json.dumps({"image_key": image_key})
        }
        
        resp = requests.post(url, headers=headers, json=data)
        return resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 获取token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('tenant_access_token',''))")

• Confidence: 98% confidence
• Finding: This request transmits a hardcoded Feishu app ID and app secret to obtain an access token. Embedding production credentials in a distributed script is a direct secret-exposure vulnerability: anyone with access to the skill can recover and abuse the secret to impersonate the application and send or access data via the Feishu API.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script silently sends both embedded credentials and user-supplied image content to Feishu without any disclosure, confirmation, or consent mechanism. In an agent-skill context this is risky because users may not realize local files are being exfiltrated to a third-party service, and the hardcoded app secret further increases the sensitivity of what is being transmitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 发送图片消息
RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

• Confidence: 86% confidence
• Finding: This request sends a message containing an uploaded image to an external Feishu recipient, which is the intended behavior of the skill but still constitutes data exfiltration of user-provided content. In this context the danger is elevated because the skill accepts arbitrary local file paths and transmits the resulting content off-host without validation, policy checks, or recipient restrictions.

Static analysis

No suspicious patterns detected.