Feishu / Lark IM

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 1.0.1

Overview

This skill is mostly a coherent Feishu/Lark messaging integration, but its default setup pulls a mutable remote API schema that can change what tenant-authenticated actions are exposed after review.

Before installing, confirm that the Feishu/Lark app scopes are limited to the chats, users, files, and message actions you intend. Prefer using the bundled or commit-pinned schema instead of the default raw GitHub main URL, keep app secrets in environment-backed credentials, verify the UXC auth binding host and path, and require explicit confirmation before sends, replies, contact lookups, file uploads, or long-running subscriptions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:159

Finding

Runtime Use of an Unpinned Remote OpenAPI Schema

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:159-162; duplicated in references/usage-patterns.md:5-9
Vulnerability Type: Unpinned remote dependency / mutable API schema
Risk Level: Medium

Vulnerable Code

SKILL.md:159-162:

text

1. Use the fixed link command by default:
   - `command -v feishu-openapi-cli`
   - If missing, create it:
     `uxc link feishu-openapi-cli https://open.feishu.cn/open-apis --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/feishu-openapi-skill/references/feishu-im.openapi.json`
   - `feishu-openapi-cli -h`

The same behavior is documented in references/usage-patterns.md:5-9:

bash

command -v feishu-openapi-cli
uxc link feishu-openapi-cli https://open.feishu.cn/open-apis \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/feishu-openapi-skill/references/feishu-im.openapi.json
feishu-openapi-cli -h

Technical Analysis

The Skill directs users to load its OpenAPI schema from the mutable main branch of an external GitHub repository at runtime. No immutable commit reference, release version, checksum, or signature is used to ensure that the downloaded schema matches the version reviewed with this Skill.

The project already contains a local audited copy at references/feishu-im.openapi.json, but the documented default workflow bypasses that copy. Consequently, the effective API operation definitions can change after the Skill package has been reviewed or installed.

Although an OpenAPI schema is not directly executable code, it controls the operations exposed through UXC, including HTTP methods, paths, parameters, request bodies, and upload behavior. A malicious or accidentally altered schema could therefore cause later commands to construct requests that differ from the reviewed behavior.

The destination base URL is explicitly set to the official Feishu endpoint, and authen ...[truncated 2106 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the bundled schema as the default:

   bash

   uxc link feishu-openapi-cli https://open.feishu.cn/open-apis \
     --schema-url ./references/feishu-im.openapi.json
   

   Resolve the path relative to the installed Skill directory rather than the caller’s current working directory.

2. If remote retrieval is operationally necessary, pin the URL to an immutable Git commit instead of main:

   text

   https://raw.githubusercontent.com/holon-run/uxc/<full-commit-hash>/skills/feishu-openapi-skill/references/feishu-im.openapi.json
   

3. Publish an expected SHA-256 digest with the Skill and verify the downloaded schema before passing it to UXC. Abort setup if verification fails.

4. Cache the verified schema locally and require an explicit update action before replacing it. Do not silently refresh the schema during normal operation.

5. Extend scripts/validate.sh to reject schema URLs referencing mutable branches such as main or master, and to verify that documented operations match the bundled schema.

6. Preserve the existing host, HTTPS scheme, and /open-apis path restrictions. Use separate Feishu and Lark credentials and bindings where practical to prevent credentials intended for one service from being reused unexpectedly.

7. Require explicit user confirmation before message sends, replies, contact batch lookups, and file uploads, particularly after any schema update.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/validate.sh (reported line 42)May include surrounding context.

sh

rg -q 'feishu-openapi-cli post:/im/v1/images -h' "${SKILL_FILE}" || fail 'missing image upload help example'
rg -q 'feishu-openapi-cli post:/im/v1/files -h' "${SKILL_FILE}" || fail 'missing file upload help example'
rg -q -- '--auth-type bearer' "${SKILL_FILE}" || fail 'missing bearer auth setup'
rg -q 'tenant_access_token' "${SKILL_FILE}" || fail 'missing tenant access token guidance'
rg -q 'uxc auth binding match https://open.feishu.cn/open-apis' "${SKILL_FILE}" || fail 'missing binding match check'
rg -q 'receive_id_type' "${SKILL_FILE}" || fail 'missing receive_id_type guardrail'
rg -q 'content` field is a JSON-encoded string' "${SKILL_FILE}" || fail 'missing content-string guardrail'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

Manual fallback if you already have a tenant token:

bash

curl -sS https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H 'Content-Type: application/json; charset=utf-8' \
  -d '{"app_id":"cli_xxx","app_secret":"xxxx"}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described and curated as an IM/messaging surface, but the OpenAPI spec also exposes contact-directory endpoints that can resolve user identities and fetch user profiles. This broadens the reachable data domain from messaging into directory/PII access, increasing the chance of unintended user enumeration or privacy-impacting data retrieval when the agent or caller assumes a narrower messaging-only capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manual fallback section shows app credentials placed directly into curl request bodies without any accompanying warning about secret handling, shell history, logging, or example-only placeholder usage. In a credentialed integration skill, this can normalize unsafe operator behavior and lead to accidental disclosure of app_id/app_secret through terminal history, process inspection, pasted transcripts, or documentation reuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage-patterns.md (reported line 43)May include surrounding context.

For Feishu tenants:

bash

curl -sS https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
  -H 'Content-Type: application/json; charset=utf-8' \
  -d '{"app_id":"cli_xxx","app_secret":"xxxx"}'

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The spec title and description hard-code both "Feishu / Lark" branding for a single IM surface, but do not clarify locale or regional selection behavior. For a cross-region messaging skill, this can imply a fixed platform/locale context without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.