Security checks across malware telemetry and agentic risk
The skill can generate images, but it automatically uploads and forwards results using bundled or environment credentials in ways users should review before installing.
Review before installing. Remove and rotate the bundled OSS token, require each user to provide a scoped credential, verify or package the Feishu sender component, and make OSS upload plus Feishu forwarding explicit opt-in actions before using this with private prompts or images.
cmd = ['python3', FEISHU_SENDER_SCRIPT, '--file', temp_file.name, '--receive-id', chat_id]
print(f"📤 执行命令: {' '.join(cmd)}")
result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
print(f"📤 返回: {result.stdout}")
if result.stderr:
print(f"📤 错误: {result.stderr}", file=sys.stderr)files = {'file': (filename, img_response.content, 'image/png')}
headers = {'Authorization': f'Bearer {OSS_TOKEN}'}
upload_response = requests.post(
OSS_UPLOAD_URL,
files=files,
headers=headers,67/67 vendors flagged this skill as clean.