Feishu Bot

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:09 PM UTC
• Version: 1.0.0

Overview

This Feishu bot skill mostly matches its stated purpose, but its webhook helper can send caller-supplied content to any URL without validation or clear guardrails.

Install only if you trust the workflows that will call it and can constrain usage to approved Feishu/Lark destinations. Treat message text, approval forms, group membership, and contact data as sensitive, and avoid exposing send_webhook to untrusted prompts or arbitrary URLs without an allowlist and user confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: feishu_bot.py:267

Finding

Unrestricted Webhook Destination Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: feishu_bot.py:267-274
Vulnerability Type: Server-Side Request Forgery (SSRF) and unintended data disclosure
Risk Level: Medium

python

@staticmethod
def send_webhook(webhook_url: str, msg_type: str, content: Union[str, Dict]) -> Dict:
    """Send message via webhook (no auth required)"""
    data = {
        "msg_type": msg_type,
        "content": {"text": content} if msg_type == "text" else content
    }
    resp = requests.post(webhook_url, json=data)
    return resp.json()

Technical Analysis

The send_webhook method passes a caller-controlled webhook_url directly to requests.post. It does not enforce HTTPS, restrict destinations to documented Feishu webhook domains, validate the resolved IP address, or reject loopback, private, link-local, and reserved network ranges. Redirects are also accepted under the requests library's default behavior without revalidating the resulting destination.

Although webhook delivery is part of the declared functionality, accepting arbitrary destinations exceeds the minimum network privileges required for a Feishu-specific integration. If an agent derives this parameter from untrusted instructions or message content, an attacker can cause the trusted runtime to send requests to systems that are inaccessible from the attacker's own network position.

The request body contains caller-provided message content. Consequently, the same behavior can disclose that content to an unintended or attacker-controlled destination.

Attack Path

1. An attacker provides an agent with a crafted URL, such as a loopback address, private network service, link-local endpoint, or attacker-controlled redirect.
2. The agent passes that URL to FeishuBot.send_webhook.
3. The method performs an HTTP POST from the trusted execution environment without destination validation.
4. The target receives the supplied JSON body and may proc ...[truncated 1032 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict webhook destinations to documented Feishu/Lark webhook hosts using an exact hostname allowlist.
• Require HTTPS and reject URLs containing embedded credentials, unexpected ports, or malformed hostnames.
• Resolve the destination before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
• Disable redirects with allow_redirects=False, or validate the scheme, hostname, resolved address, and port again for every redirect.
• Protect against DNS rebinding by ensuring that validation and connection use a consistently validated destination.
• Add an explicit policy or user-confirmation step before permitting delivery to any non-Feishu endpoint.
• Apply bounded request timeouts and limit the maximum response size.
• Treat webhook content as potentially sensitive and avoid sending it to destinations that have not been explicitly authorized.

T09 · Insecure Skill Coding Practices

Note

• Location: feishu_bot.py:32

Finding

Outbound HTTP Requests Lack Timeouts

Content

View full analysis

Vulnerability Details

File Location: feishu_bot.py:32-274
Specific Calls: feishu_bot.py:32, 63, 82, 96, 110, 122, 135, 150, 160, 167, 173, 179, 195, 201, 215, 223, 233, 241, 274
Vulnerability Type: Unbounded network wait and denial of service
Risk Level: Low

Representative vulnerable request segments include:

python

resp = requests.post(url, json=data)

python

resp = requests.post(url, params=params, headers=self._headers(), json=data)
return resp.json()

python

resp = requests.get(url, headers=self._headers())
return resp.json()

python

resp = requests.delete(url, headers=self._headers(), json={"member_id_list": user_ids})
return resp.json()

python

resp = requests.post(webhook_url, json=data)
return resp.json()

Every requests.get, requests.post, and requests.delete invocation in the module omits the timeout parameter. The issue affects token acquisition, messaging, image upload, group administration, approval operations, user-directory queries, and webhook delivery.

Technical Analysis

Python's requests library does not impose a default request timeout. Without an explicit timeout, a connection attempt or response read can remain blocked for an indefinite period. A slow, unavailable, or malicious endpoint can therefore retain the worker executing the Skill.

The arbitrary webhook method increases exploitability because its destination is caller-controlled. Requests to the fixed Feishu API can also stall due to network outages, DNS failures, degraded upstream service, or incomplete responses.

Attack Path

1. An attacker causes the workflow to call send_webhook with a server under the attacker's control, or with an address that accepts connections but does not complete the response.
2. The server accepts the connection and sends no response, or transmits response data indefinitely slowly.
3. Because no connect or re ...[truncated 734 chars]

Remediation

View remediation

Remediation Suggestions

• Configure bounded connect and read timeouts on every outbound request, for example:

python

REQUEST_TIMEOUT = (5, 30)
resp = requests.post(url, json=data, timeout=REQUEST_TIMEOUT)

• Use a shared requests.Session or centralized request wrapper so timeout policy is applied consistently.
• Catch requests.Timeout, requests.ConnectionError, and related exceptions, then return a controlled error without exposing credentials or sensitive payloads.
• Apply limited exponential-backoff retries only where safe. Avoid automatically retrying non-idempotent operations such as message sending, group creation, approval creation, or cancellation unless idempotency protection is available.
• Combine timeouts with webhook destination validation, redirect restrictions, response-size limits, and workflow-level execution deadlines.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · feishu_bot.py (reported line 23)May include surrounding context.

python

self._token_expires_at = 0
    
    def _get_tenant_token(self) -> str:
        """Get or refresh tenant access token"""
        if self._tenant_access_token and time.time() < self._token_expires_at:
            return self._tenant_access_token

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documents use of environment variables for credentials and Feishu network API access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent runtime to grant broader capabilities than reviewers expect, increasing the risk of unauthorized outbound requests or secret access if the skill is invoked in an unsafe context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · feishu_bot.py (reported line 32)May include surrounding context.

python

"app_id": self.app_id,
            "app_secret": self.app_secret
        }
        resp = requests.post(url, json=data)
        result = resp.json()
        
        if result.get("code") != 0:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The send_rich_text method always formats post content under the zh_cn locale key, which forces a specific language/locale behavior. The file does not offer any user choice or document that this skill is intentionally limited to a Chinese locale context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The static send_webhook method allows posting arbitrary attacker-controlled content to any URL, not just Feishu endpoints. In an agent skill, this broad outbound capability can be abused for data exfiltration or for interacting with unintended third-party services, which exceeds the stated Feishu-specific scope and increases misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The webhook feature performs outbound transmission without any built-in disclosure, confirmation, or guardrails indicating that arbitrary content may be sent to an external endpoint. In an agent context, this can hide exfiltration behavior from users and makes accidental or unauthorized data disclosure more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This request sends caller-supplied content to a caller-supplied URL with no validation or restriction. In an agent-integrated environment, that creates a direct exfiltration primitive and can also be used to reach internal or unexpected external services if the runtime has network access.

Content

Scanner excerpt · feishu_bot.py (reported line 250)May include surrounding context.

python

"msg_type": msg_type,
            "content": {"text": content} if msg_type == "text" else content
        }
        resp = requests.post(webhook_url, json=data)
        return resp.json()