Security audit
Security checks across malware telemetry and agentic risk
This skill does what it claims, but it can use stored Feishu credentials to automatically send generated investment reports to a fixed recipient.
Review before installing. Confirm the hard-coded Feishu recipient, restrict the Feishu app credentials to the minimum message/file permissions, require confirmation before scheduled or automatic sends, and verify the external PDF converter dependency. Treat the generated market analysis as informational rather than financial advice.
user_id = "ou_159cbb6a3791ff5a98f3a2a4b38e7d4c"
pdf_path = "/tmp/tech-invest-YYYYMMDD.pdf"
token = requests.post(
"https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
json={"app_id": app_id, "app_secret": app_secret}
).json()["tenant_access_token"]).json()["tenant_access_token"]
with open(pdf_path, "rb") as f:
file_key = requests.post(
"https://open.feishu.cn/open-apis/im/v1/files",
headers={"Authorization": f"Bearer {token}"},
data={"file_type": "pdf", "file_name": Path(pdf_path).name},files={"file": f}
).json()["data"]["file_key"]
requests.post(
"https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
json={"receive_id": user_id, "msg_type": "file", "content": json.dumps({"file_key": file_key})}user_id = "ou_159cbb6a3791ff5a98f3a2a4b38e7d4c"
pdf_path = "/tmp/tech-invest-YYYYMMDD.pdf"
token = requests.post(
"https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",
json={"app_id": app_id, "app_secret": app_secret}
).json()["tenant_access_token"]files={"file": f}
).json()["data"]["file_key"]
requests.post(
"https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
json={"receive_id": user_id, "msg_type": "file", "content": json.dumps({"file_key": file_key})}65/65 vendors flagged this skill as clean.
No suspicious patterns detected.