飞书图片消息

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:51 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but it disables normal HTTPS identity checks while handling Feishu credentials, image files, and message sending.

Review before installing. Only use this skill with Feishu app credentials you are prepared to expose to the skill, and avoid using the current version on untrusted networks because it disables normal server-certificate checks. The maintainer should restore default TLS verification, narrow activation phrases to explicit Feishu requests, and add clear confirmation/risk guidance for sending local files to chats and writing downloaded images to disk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/feishu_image.py:33

Finding

TLS Certificate and Hostname Verification Disabled for All Feishu API Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/feishu_image.py, lines 33–36; the insecure context is used at lines 79, 134, 173, 195, and 231
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code

python

# Create a context that does not verify SSL certificates
SSL_CONTEXT = ssl.create_default_context()
SSL_CONTEXT.check_hostname = False
SSL_CONTEXT.verify_mode = ssl.CERT_NONE

The context is passed to every Feishu API request, for example:

python

with urllib.request.urlopen(req, timeout=30, context=SSL_CONTEXT) as resp:
    result = json.loads(resp.read().decode("utf-8"))

Equivalent uses occur in token acquisition, image upload, message delivery, image download, and image viewing.

Technical Analysis

Setting check_hostname to False prevents verification that the server certificate belongs to open.feishu.cn. Setting verify_mode to ssl.CERT_NONE disables certificate-chain validation. Consequently, TLS encrypts the connection but does not authenticate the remote endpoint.

This affects all requests made by the script. Of particular concern, the token endpoint receives the Feishu app_id and app_secret in the request body. Subsequent operations transmit the tenant bearer token, uploaded image contents, recipient identifiers, image keys, and message data.

A network-positioned attacker who can intercept or redirect traffic can present an arbitrary certificate, impersonate the Feishu API, and read or modify these requests. No certificate warning or validation failure will stop the connection.

The base64 conversion in the view command is not independently malicious: it encodes downloaded image bytes for the documented local output behavior. Likewise, communication with the fixed Feishu API endpoint is required by the declared functionality. The security issue is that these necessary communications occur without authenticating the endpoin ...[truncated 1774 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the global context that disables certificate and hostname verification.

2. Use Python's default verified TLS behavior:

   python

   with urllib.request.urlopen(req, timeout=30) as resp:
       result = json.loads(resp.read().decode("utf-8"))
   

3. Apply the same change to every request at lines 79, 134, 173, 195, and 231.

4. If a custom certificate authority is genuinely required, create a validating context using an explicitly trusted CA bundle:

   python

   SSL_CONTEXT = ssl.create_default_context(cafile="/path/to/trusted-ca.pem")
   

   Keep hostname verification enabled and use ssl.CERT_REQUIRED.

5. Do not use ssl.CERT_NONE or disable check_hostname as a workaround for local certificate-store problems. Repair the host CA store or configure the correct CA bundle instead.

6. Avoid exposing credentials or bearer tokens in exceptions and logs. Maintain the current behavior of not printing them directly.

7. After deploying the fix, rotate the Feishu application secret and revoke or refresh relevant tokens if the insecure version was used on an untrusted network.

8. Add an automated test that connects to an endpoint with an untrusted or hostname-mismatched certificate and verifies that the request fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script globally disables both TLS certificate validation and hostname verification for every Feishu API request. This allows a man-in-the-middle attacker on the network to intercept or alter authentication, image upload/download, and message-sending traffic, potentially exposing app credentials, tokens, image contents, and message operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code silently performs all network operations with certificate and hostname verification disabled, giving users no indication that transport security has been weakened. In the context of a skill that handles Feishu credentials, access tokens, image content, and outbound messages, this materially increases the chance of credential theft, data disclosure, and unauthorized message manipulation if network traffic is intercepted.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes capabilities to read local files and perform network actions, but the manifest does not declare any tool scope or permission boundaries. In an agent setting, this weakens reviewability and increases the chance the skill is invoked with broader access than users expect, enabling unintended local file access and data transmission to Feishu.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation phrases include generic terms like '发送图片', '上传图片', '获取图片', and '下载图片', which can match ordinary image-handling requests unrelated to Feishu. This can cause the skill to trigger in the wrong context and send or fetch images through Feishu unexpectedly, creating a real risk of unintended data disclosure or outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description explains functionality but does not clearly warn users that it can transmit local images to external Feishu chats and save downloaded remote images onto local disk. In this context, the missing warning is dangerous because the skill bridges local files and external messaging, so users may not realize they are authorizing data exfiltration or filesystem writes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The comment understates the security effect by framing it as a macOS compatibility workaround, while the code actually disables TLS protections for all connections. This misleading justification increases risk because maintainers and users may not realize that all Feishu API traffic is exposed to interception or tampering.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description only says this is a 'Feishu image message operation skill,' which is a broad capability statement rather than a specific trigger or invocation scope. It does not define what user phrases, contexts, or constraints should activate the skill, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Natural-language strings in the module docstring and CLI help force a specific language/locale without indicating that users can select another language. Under the policy, language constraints should be optional or clearly justified; no such opt-in or justification is present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.