Feishu Send File 1.2.1
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and instructions align with its stated purpose (sending local files/images to Feishu/Lark); main issues are minor inconsistencies and operational security considerations (use of curl and passing secrets on the command line).
This skill appears to do what it says: upload local files/images to Feishu/Lark using the official APIs. Before installing or running it, note these practical points: (1) The Python scripts call curl but the skill metadata does not declare curl as a required binary — ensure curl is available on the host. (2) The scripts expect app_id and app_secret as command-line arguments; supplying secrets on the CLI can expose them to other local users via process listings. Prefer running in a trusted environment or modifying the scripts to read secrets from a secured file or environment variable if you need tighter secrecy. (3) Confirm the app_id/app_secret you supply have only the permissions required for sending messages/files. (4) The scripts only contact official open.feishu.cn or open.larksuite.com endpoints and do not phone home elsewhere. If any of these points are unacceptable (e.g., you cannot expose secrets on the command line), request an updated version that avoids CLI-secret exposure and explicitly documents required binaries.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.