飞书图片发送

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:27 PM UTC
• Version: 1.0.0

Overview

The skill’s Feishu image-sending purpose is clear, but it publishes a real-looking app secret and gives broad raw API examples for uploading local images and sending them to recipients.

Review this skill before installing or using it. The Feishu app secret shown in the published example should be considered exposed and rotated by its owner; users should replace it with their own securely stored credentials, confirm recipient IDs, and only upload images they intend to send to Feishu. Prefer the serialized Node.js-style request construction or a JSON serializer over the shell string interpolation example.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:59

Finding

Hardcoded Feishu Application Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-60
Vulnerability Type: Hardcoded reusable authentication credentials
Risk Level: High

Vulnerable Code

bash

APP_ID="cli_a924632610b8dbd9"
APP_SECRET="c3TXscIJPF1f8jcQ4mJJegNVk72ktbwK"

Technical Analysis

The Skill contains a plausible Feishu application identifier and application secret directly in a distributable example. Anyone with access to the Skill can recover these credentials without needing access to a separate secret store.

The document subsequently uses the credentials to request a tenant access token from Feishu's official authentication endpoint. Although sending credentials to that endpoint is necessary for the declared image-sending functionality, embedding reusable credentials in the Skill is not necessary and violates least-privilege and secret-management practices.

The exposed secret may allow an attacker to authenticate as the associated Feishu application if the credentials remain active. The actual privileges available to an attacker depend on the permissions granted to that application in Feishu.

Attack Path

1. An attacker obtains or reads the distributed SKILL.md file.
2. The attacker extracts the embedded APP_ID and APP_SECRET.
3. The attacker submits the credentials to: https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal.
4. If the credentials are valid, Feishu returns a tenant access token.
5. The attacker uses that token to call Feishu APIs authorized for the application.
6. Possible follow-on actions include uploading images, sending messages, consuming API quotas, or invoking any other API permitted by the application's assigned scopes.

Impact Assessment

Successful exploitation may provide unauthorized access to the Feishu application's tenant-level API privileges. The precise scope is bounded by the permissions assigned to the application, but it could include unaut ...[truncated 349 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed Feishu application secret immediately.
2. Replace both credential values in documentation with clearly nonfunctional placeholders.
3. Load credentials at runtime from environment variables or a dedicated secret manager.
4. Do not print, log, cache, or return application secrets or tenant access tokens.
5. Restrict access to the runtime secret to the process and operators that require it.
6. Configure the Feishu application with only the scopes required to upload images and send messages.
7. Review Feishu authentication and API audit logs for unauthorized token issuance or API calls made using the exposed credentials.
8. Add automated secret scanning to the repository and release process to prevent future credential inclusion.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:73

Finding

Unsafe JSON Construction from Caller-Controlled Recipient Identifier

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:73-77
Vulnerability Type: JSON injection through unsafe string interpolation
Risk Level: Medium

Vulnerable Code

bash

# 3. Send image
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"$OPEN_ID\",\"msg_type\":\"image\",\"content\":\"{\\\"image_key\\\":\\\"$IMAGE_KEY\\\"}\"}"

Technical Analysis

The shell example constructs JSON by directly interpolating OPEN_ID and IMAGE_KEY into a quoted string. Neither value is encoded with a JSON serializer. A caller-controlled OPEN_ID containing quotation marks, backslashes, control characters, or JSON syntax can terminate or alter the intended JSON string.

Shell double-quote handling does not re-evaluate shell metacharacters introduced through variable expansion, so this is not demonstrated as arbitrary shell command execution. The confirmed risk is manipulation or corruption of the JSON request submitted to the fixed Feishu endpoint.

IMAGE_KEY originates from Feishu's upload response and is therefore less directly attacker-controlled, but it should still be serialized rather than assumed to contain only safe characters.

Attack Path

1. An attacker or untrusted caller supplies a crafted value as the script's second argument, which is assigned to OPEN_ID.
2. The value is inserted directly into the JSON body without JSON escaping.
3. Embedded quotation marks or JSON syntax terminate or modify the intended receive_id value.
4. The script submits the resulting malformed or attacker-influenced body to the Feishu message API.
5. Depending on Feishu's JSON parser and field validation, the request may fail, use altered fields, or target an unintended recipient represented by the manipulated request.

Impact Assessment

The issue can cause malfor ...[truncated 506 chars]

Remediation

View remediation

Remediation Suggestions

1. Construct the request body with a real JSON serializer rather than shell string interpolation.

2. Pass values to jq, Python, or another serializer as data arguments. For example:

   bash

   BODY=$(jq -n \
     --arg receive_id "$OPEN_ID" \
     --arg image_key "$IMAGE_KEY" \
     '{
        receive_id: $receive_id,
        msg_type: "image",
        content: ({image_key: $image_key} | tojson)
      }')
   
   curl -sS -X POST \
     "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
     -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/json" \
     --data-binary "$BODY"
   

3. Validate OPEN_ID against the documented Feishu identifier format before sending the request.

4. Reject empty identifiers, control characters, and values exceeding the expected length.

5. Check HTTP status codes and Feishu response codes before reporting success.

6. Continue using JSON.stringify, as shown in the Node.js example, for programmatic request construction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs access-token retrieval and later includes a hardcoded app secret in the example script, which constitutes credential exposure in documentation. Anyone with access to the skill can potentially reuse the embedded secret to obtain tokens and act as the Feishu application, leading to unauthorized messaging and possible broader API abuse.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

操作步骤

第一步：获取 Access Token

bash

curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a workflow that transmits app credentials, access tokens, local image files, and recipient identifiers to an external messaging platform, but provides no privacy, consent, retention, or safe-handling guidance. In addition, the included example hardcodes a real-looking app secret, which materially raises the chance of credential leakage and unauthorized use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

第一步：获取 Access Token

bash

curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 74% confidence

Finding

This step transmits an image reference to a specific recipient identifier, enabling targeted delivery of user-facing content through an external platform. In context, the skill is explicitly meant to bypass another plugin's limitation, and without authorization, consent, or recipient-validation controls it can facilitate unintended data disclosure or social-engineering delivery.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

python3 -c "import sys,json; print(json.load(sys.stdin)['data']['image_key'])")

# 3. 发送图片
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"$OPEN_ID\",\"msg_type\":\"image\",\"content\":\"{\\\"image_key\\\":\\\"$IMAGE_KEY\\\"}\"}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

async function feishuSendImage(imagePath, openId, appId, appSecret) {
  // 1. get token
  const tokenRes = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ app_id: appId, app_secret: appSecret })

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

This code reads an arbitrary local file path and uploads the file contents to an external service, which can expose sensitive local images or screenshots if the caller supplies an unsafe path or if users are not informed of the upload. In the context of an agent skill designed to bypass a platform restriction and send user-targeted images, this external transmission is more sensitive than a routine API call.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

// 2. upload image
  const imageBuffer = fs.readFileSync(imagePath);
  const uploadRes = await fetch('https://open.feishu.cn/open-apis/im/v1/images', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${tenant_access_token}` },
    body: (() => {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions and description are entirely in Chinese, and the file does not indicate that the skill is region-specific or provide an opt-in language choice. Per the language/locale policy rule, forcing a single language without user choice or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.