飞书表情回复

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:25 AM UTC
• Version: 1.1.1

Overview

The skill is related to Feishu emoji reactions, but it deserves review because it encourages automatic chat actions, local learning state, credential-bearing scripts, and unpinned npm installs.

Review before installing in shared or business Feishu workspaces. Use the smallest Feishu app permission, avoid the optional unpinned npm CLI/SDK paths unless you can pin and audit them, keep credentials out of shell history and broad environments, and disable or constrain automatic learning/reaction behavior if users have not explicitly opted in.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:231
• Finding: Unpinned Global CLI Installation Creates a Supply-Chain Code Execution Risk## Vulnerability Details **File Location**: `SKILL.md:231-234` **Vulnerability Type**: Unpinned third-party package installed globally **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @larksuite/cli lark-cli config init ``` ### Technical Analysis The installation instructions retrieve the latest available version of `@larksuite/cli` from the user's configured npm registry and install it globally. No exact version, lockfile, or package-integrity verification is specified. npm packages may execute lifecycle scripts during installation. A compromised maintainer account, registry response, package release, or registry configuration could therefore cause arbitrary code to execute with the privileges of the user running the installation. Global installation also exposes the package beyond this Skill's project directory and is not necessary for the declared reaction functionality because the repository already includes a direct HTTPS implementation. This finding does not indicate that the named package is currently malicious. It identifies an unsafe, mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the upstream package, a maintainer account, or the npm registry path used by the victim. 2. The attacker publishes or serves a malicious release under the expected package name. 3. A user follows the Skill instructions and runs `npm install -g @larksuite/cli`. 4. npm downloads the mutable latest release and may execute malicious lifecycle scripts. 5. The installed CLI is subsequently invoked through `lark-cli config init`, providing another opportunity for attacker-controlled code to run. 6. The payload executes as the installing user and may access files, environment variables, network resources, and user-level configuration available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the current user's privileges. Th ...[truncated 355 chars]
• Remediation: ## Remediation Suggestions - Avoid global installation and prefer a project-local dependency. - Pin the dependency to an exact, reviewed version rather than accepting the latest release. - Declare the dependency in `package.json` and commit a lockfile with integrity hashes. - In documented workflows, use `npm ci` against the committed lockfile. - Verify that the configured registry is the expected trusted registry before installation. - Review package provenance, signatures, published contents, and lifecycle scripts before approving upgrades. - Prefer the included direct Feishu API implementation when a separate CLI is unnecessary. - If the CLI remains optional, clearly warn users that installation executes third-party code with their account privileges.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:243
• Finding: Unpinned Feishu SDK Dependency Can Execute Mutable Third-Party Code with Credential Access## Vulnerability Details **File Location**: `SKILL.md:243-245`; runtime import at `scripts/add_reaction_sdk.js:19` **Vulnerability Type**: Unpinned runtime dependency with access to application credentials **Risk Level**: Medium ### Vulnerable Code Installation instruction: ```bash npm install @larksuiteoapi/node-sdk node scripts/add_reaction_sdk.js om_message_id THUMBSUP ``` Runtime import: ```javascript const Lark = await import('@larksuiteoapi/node-sdk'); ``` The imported package is subsequently initialized with credentials obtained from the process environment: ```javascript const APP_ID = process.env.FEISHU_APP_ID_INSTANCE2; const APP_SECRET = process.env.FEISHU_APP_SECRET_INSTANCE2; const client = new Lark.default.Client({ appId: APP_ID, appSecret: APP_SECRET, domain: Lark.default.Domain.Feishu, }); ``` ### Technical Analysis The Skill tells users to install `@larksuiteoapi/node-sdk` without an exact version or a committed lockfile. The runtime script then dynamically imports whichever package version was resolved into `node_modules`. A malicious or compromised dependency can execute code during npm lifecycle hooks and again when the module is imported. During runtime, the Node.js process contains `FEISHU_APP_ID_INSTANCE2` and `FEISHU_APP_SECRET_INSTANCE2` in its environment. Imported JavaScript executes in the same process and security context as the Skill script, so it can read these credentials directly, modify API behavior, access local files, or transmit data to an external destination. The package name is consistent with the documented Lark SDK, and the reviewed code does not demonstrate current malicious behavior. The vulnerability is the absence of dependency pinning and artifact verification around code that runs in a credential-bearing process. ### Attack Path 1. An attacker compromises the SDK publisher, an upstream dependency, a registry account, or the registry path ...[truncated 1308 chars]
• Remediation: ## Remediation Suggestions - Add `@larksuiteoapi/node-sdk` to `package.json` at an exact reviewed version. - Generate and commit a package lockfile containing integrity hashes. - Replace ad hoc `npm install` instructions with `npm ci`. - Audit the SDK and its transitive dependency tree before updates. - Use trusted registry configuration and verify package provenance where supported. - Disable dependency lifecycle scripts during installation when they are not required, for example through an appropriately tested `--ignore-scripts` workflow. - Run the SDK script with a minimal environment and avoid exposing unrelated credentials to the process. - Ensure the Feishu application retains only `im:message.reactions:write_only` and remove any unrelated permissions. - Prefer the direct API script if avoiding the SDK dependency is practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (28)

Scope Creep

High

• Confidence: 94% confidence
• Finding: The documented prerequisite claims only Feishu reaction write permission, yet the skill also describes writing learned emoji data to local storage. This mismatch can mislead operators into granting or approving the skill under a narrower trust assumption while it performs additional stateful behavior that may affect privacy, auditability, and system integrity.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a higher-level behavioral skill involving judgment, interpretation, contextual understanding, and self-learning around Feishu reactions. The actual code is only a low-level utility for adding a reaction to a message when given explicit inputs. While adding Feishu reactions is related to the topic, the implemented functionality is far narrower and lacks the core described capabilities. Therefore the description does not accurately represent what the code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a high-level agent behavior skill with decision-making, reaction interpretation, cultural semantics, and self-learning. The supplied code does none of that. It is only a narrow utility that performs one action: add a given emoji reaction to a given Feishu message when explicitly invoked with parameters. Its primary purpose is materially different from the declared autonomous/interactive skill behavior, and it also includes implementation-specific behavior (hardcoded accountId and local module imports) absent from the description. Therefore this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a high-level agent behavior system for nuanced emoji-reaction use in Feishu, including judgment, interpretation, cultural semantics, and self-learning. The supplied code only performs one narrow action: adding a specified reaction to a specified message using the Feishu SDK. While this is loosely related to Feishu emoji replies, it does not implement the core declared behaviors. There are no undeclared dangerous capabilities, but the actual functionality is materially narrower and different from the declared purpose, so this should be flagged as a mismatch.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: feishu-emoji-reaction
description: |
  让 Agent 学会用飞书表情回复：主动表达情绪、读懂用户 reaction 并回应、自学新表情。包含静默判断（什么时候该回、什么时候闭嘴）、文化语境（SMILE=呵呵、OnIt=在做了）、自学习闭环。
---

# 飞书表情回复

让 Agent 学会用表情说话——主动表达、读懂情绪、知道什么时候该回应什么时候该闭嘴。

## 快速开始

```javascript
// 给当前消息加表情
message({
  action: "react",
  channel: "feishu",
  emoji: "THUMBSUP"
})
```

## 核心概念

### 1. 添加表情

用表情回�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: feishu-emoji-reaction
description: |
  让 Agent 学会用飞书表情回复：主动表达情绪、读懂用户 reaction 并回应、自学新表情。包含静默判断（什么时候该回、什么时候闭嘴）、文化语境（SMILE=呵呵、OnIt=在做了）、自学习闭环。
---

# 飞书表情回复

让 Agent 学会用表情说话——主动表达、读懂情绪、知道什么时候该回应什么时候该闭嘴。

## 快速开始

```javascript
// 给当前消息加表情
message({
  action: "react",
  channel: "feishu",
  emoji: "THUMBSUP"
})
```

## 核心概念

### 1. 添加表情

用表情回�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Self-Modification

High

• Category: Rogue Agent

Content

2. **Context matters** — Note the situation where users use specific emoji
3. **Keep a vocabulary** — Maintain your learned emoji list in a persistent file
4. **Ask when unsure** — If an emoji's meaning is unclear, ask the user
5. **Update this skill** — If you discover many new emoji, consider updating this documentation

### Example Learning Session

• Confidence: 97% confidence
• Finding: The instruction to 'update this skill' encourages self-modification of the skill's own documentation or behavior based on newly observed user inputs. That creates a classic prompt/policy poisoning channel where adversarial users can influence future agent behavior by causing persistent changes to trusted skill content.

Credential Access

High

• Category: Privilege Escalation

Content

fi

# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{
    \"app_id\": \"$FEISHU_APP_ID_INSTANCE2\",

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Credential Access

High

• Category: Privilege Escalation

Content

TENANT_ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | python3 -c "import sys, json; print(json.load(sys.stdin).get('tenant_access_token', ''))")

if [ -z "$TENANT_ACCESS_TOKEN" ]; then
  echo "错误: 无法获取 access token"
  echo "$TOKEN_RESPONSE"
  exit 1
fi

• Confidence: 82% confidence
• Finding: If token acquisition fails, the script prints the full TOKEN_RESPONSE. Authentication error payloads can contain sensitive operational details and, depending on API behavior or proxies, may expose token material or credential-related diagnostics into logs visible to other users or systems. In an agent skill context, log leakage is more dangerous because outputs may be stored, surfaced to users, or forwarded into monitoring pipelines.

External Script Fetching

High

• Category: Supply Chain

Content

# 添加表情回复
echo "正在添加表情回复: $EMOJI_TYPE 到消息 $MESSAGE_ID ..."
REACTION_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages/$MESSAGE_ID/reactions" \
  -H "Authorization: Bearer $TENANT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The documentation presents a culturally specific interpretation of emoji as a default behavior rather than a configurable preference. This can cause the agent to misread user intent and generate inappropriate or socially harmful responses, especially in mixed-language or cross-cultural environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes autonomous 'self-learning' that will attempt unknown emoji through the API as soon as they are observed. That creates unintended outbound actions without user confirmation or clear operator awareness, which can surprise users, leak behavioral signals, and cause the agent to perform side effects based on untrusted input.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The cultural-context table hard-codes Chinese internet-slang meanings as authoritative defaults for multiple emoji. In practice this can systematically bias the agent's responses, leading to misunderstanding, reputational harm, and potentially manipulative behavior if users are interpreted through the wrong cultural lens.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The README describes persistent self-learning that stores newly observed emoji mappings into a local memory file, which materially expands the skill's behavior beyond simple message reactions. Persistent writes create an undeclared data retention surface and can capture user-derived content without clear consent, review, or bounds.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill description states that it has '中文互联网黑话内置', indicating a built-in Chinese cultural/linguistic interpretation model. This is a locale/language-specific behavior presented as a default capability, with no mention of user choice or opt-in, which can violate language/locale policy requirements.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents executable shell/CLI/SDK paths and environment-variable based credential use, but does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, that mismatch can cause the runtime or reviewer to underestimate what capabilities the skill may induce the agent to use, increasing the chance of unintended shell access or secret exposure.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill expands from simple message reactions into direct shell, CLI, and Node execution paths with credential handling instructions. In an agent environment, such embedded operational instructions can trigger broader tool usage than expected and expose secrets or enable unintended command execution workflows outside the core skill purpose.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation text is overly broad and can cause the skill to trigger during ordinary conversation whenever users mention likes, emoji, or reactions. In an agent environment with side-effectful tools, this increases the chance of unintended message reactions being sent without clear user intent, creating confusing or unauthorized actions.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The documentation includes Chinese-specific phrasing such as '比 crush 难聊' and later examples and mappings that frame responses in Chinese internet culture. Because the skill does not say this language/cultural behavior is optional or user-selected, it risks forcing a specific language/locale style on users.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The learned emoji vocabulary and cultural notes map emoji meanings using Chinese phrases such as '无语', '在做了', '懂了', and '呵呵'. This embeds a specific locale and language assumption into the skill's behavior without indicating that the agent should adapt to the user's preferred language.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 获取 tenant_access_token
echo "正在获取 access token..."
TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{
    \"app_id\": \"$FEISHU_APP_ID_INSTANCE2\",

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 添加表情回复
echo "正在添加表情回复: $EMOJI_TYPE 到消息 $MESSAGE_ID ..."
REACTION_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages/$MESSAGE_ID/reactions" \
  -H "Authorization: Bearer $TENANT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file's natural-language documentation and runtime user-facing messages are exclusively in Chinese, including the usage instructions. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The documentation instructs users to place app credentials into environment variables and use external APIs without any warning about secret storage, logging, history leakage, or least-privilege practices. While not an exploit by itself, this increases the likelihood of accidental credential exposure in terminals, CI logs, or shared environments.

Static analysis

No suspicious patterns detected.