小爱舆情结果飞书推送

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.1.0

Overview

This Feishu automation mostly matches its stated purpose, but it needs Review because it evaluates Python rules, sends table data to a user-supplied webhook, and may resend records unexpectedly.

Install only if you trust the publisher and will supply trusted rule expressions yourself. Use a narrowly scoped Feishu app, send only non-sensitive fields to a webhook you control, and review/fix the duplicate execution path, webhook host validation, eval-based rule engine, and dependency pinning before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

eval() call detected

High

• Category: Dangerous Code Execution

Content

safe_globals = {"__builtins__": {}}
    safe_locals = {"fields": fields}
    try:
        return bool(eval(rule_expression, safe_globals, safe_locals))
    except Exception:
        return False

• Confidence: 98% confidence
• Finding: return bool(eval(rule_expression, safe_globals, safe_locals))

eval() call detected

High

• Category: Dangerous Code Execution

Content

safe_globals = {"__builtins__": {}}
    safe_locals = {"fields": fields}
    try:
        return bool(eval(rule_expression, safe_globals, safe_locals))
    except Exception:
        return False

• Confidence: 98% confidence
• Finding: return bool(eval(rule_expression, safe_globals, safe_locals))

Scope Creep

Medium

• Confidence: 91% confidence
• Finding: The manifest asks the user for a Feishu bot webhook URL but only declares network permission for open.feishu.cn, creating a mismatch between documented behavior and declared egress. That can undermine permission enforcement, mislead reviewers, or encourage broader runtime network access than the manifest communicates, which is risky for a skill that forwards table-derived content externally.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstring claims a 'restricted eval', but the implementation still executes arbitrary Python expressions via eval(). This mismatch is security-relevant because it can mislead reviewers and operators into believing the input is sandboxed when it is not, increasing the chance the dangerous feature is enabled in production.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes pulling data from a Feishu Bitable and forwarding rendered record content to a Feishu group webhook, but it does not warn users that table data may contain personal, confidential, or regulated information that will be copied into a group chat. This omission increases the chance of accidental oversharing, especially because the skill supports arbitrary message templates and condition rules that can expose sensitive fields at scale.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The description explains functionality but does not clearly warn users that record contents from the table will be transmitted to an external group webhook and that the source table's push-status field will be modified. This weakens informed consent and increases the chance of accidental data leakage or unintended record mutation, especially because message content is derived from arbitrary fields and templates.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.0
urllib3>=1.26.0

• Confidence: 93% confidence
• Finding: requests>=2.25.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.0
urllib3>=1.26.0

• Confidence: 93% confidence
• Finding: urllib3>=1.26.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: requests

Known Vulnerable Dependency: urllib3 — 10 advisory(ies): CVE-2025-66471 (urllib3 streaming API improperly handles highly compressed data); CVE-2024-37891 (urllib3's Proxy-Authorization request header isn't stripped during cross-origin ); CVE-2026-21441 (Decompression-bomb safeguards bypassed when following HTTP redirects (streaming ) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: urllib3

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: push_skill.py:103