Feishu Thread Forward

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it forwards Feishu threads using Feishu APIs, but users should treat that as intentional sharing of chat content and handle bot credentials carefully.

Install only if you want agents to forward Feishu thread content. Before using it, verify the source thread and destination ID, confirm the target audience is allowed to see the content, and ensure the Feishu app credentials are least-privilege, access-controlled, and not logged or copied into prompts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/forward_thread.py (reported line 81)May include surrounding context.

python

def main():
    parser = argparse.ArgumentParser(description="Forward a Feishu thread")
    parser.add_argument("--thread-id", help="Thread ID (omt_xxx)")
    parser.add_argument("--message-id", help="Message ID to extract thread_id from")
    parser.add_argument("--receive-id", required=True, help="Target ID")
    parser.add_argument(
        "--receive-id-type",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documents direct network access to the Feishu Open API but does not declare any explicit tool scope or allowed-tools boundary. That omission weakens security review and runtime governance because a consumer cannot easily tell that the skill can perform outbound actions that move data between chats.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This skill is specifically designed to forward thread content to other users, groups, or topics, but the usage guidance does not warn about privacy, confidentiality, or accidental cross-group disclosure. In context, this increases the chance of users or agents forwarding sensitive discussions into unintended audiences, which is exactly the core action of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs readers to read app credentials from a local secrets file in order to obtain a tenant access token, but provides no caution on secret handling, storage, redaction, or least-privilege usage. That can normalize unsafe handling of sensitive credentials and increase the risk of token theft or accidental disclosure through logs, scripts, or debugging output.

Content

No source excerpt is available for this finding.

Tainted flow: 'req' from urllib.request.urlopen (line 62, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/forward_thread.py (reported line 30)May include surrounding context.

python

data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(),
        headers={"Content-Type": "application/json"},
    )
    resp = json.loads(urllib.request.urlopen(req).read())
    if resp.get("code", -1) != 0:
        print(f"ERROR: Failed to get token: {resp}", file=sys.stderr)
        sys.exit(1)

Tainted flow: 'req' from urllib.request.urlopen (line 62, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/forward_thread.py (reported line 42)May include surrounding context.

python

data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(),
        headers={"Content-Type": "application/json"},
    )
    resp = json.loads(urllib.request.urlopen(req).read())
    if resp.get("code", -1) != 0:
        print(f"ERROR: Failed to get token: {resp}", file=sys.stderr)
        sys.exit(1)

Tainted flow: 'req' from urllib.request.urlopen (line 62, network input) → urllib.request.urlopen (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/forward_thread.py (reported line 71)May include surrounding context.

python

data=json.dumps({"app_id": app_id, "app_secret": app_secret}).encode(),
        headers={"Content-Type": "application/json"},
    )
    resp = json.loads(urllib.request.urlopen(req).read())
    if resp.get("code", -1) != 0:
        print(f"ERROR: Failed to get token: {resp}", file=sys.stderr)
        sys.exit(1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script forwards an entire Feishu thread to a specified recipient with no confirmation, recipient verification, or warning that conversation contents will be transmitted elsewhere. In a messaging skill whose core purpose is redistribution of thread content, this materially increases the risk of accidental data leakage to the wrong user, group, or topic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.