Security audit

Feishu Integration

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Feishu integration, but it ships with an exposed app secret and can make broad live changes in Feishu without strong safeguards.

Review carefully before installing. Use your own Feishu app credentials, rotate any bundled or copied secret, restrict the Feishu app to least-privilege scopes, avoid running the cron welcome bot unless you want recurring automated messages, and require explicit confirmation before document writes, uploads, message sends, chat creation, or chat deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: When the input starts with a user OpenID, the script calls the Feishu P2P chat creation endpoint before reading message history. That introduces a write-side effect in a tool whose apparent purpose is read-only retrieval, which can unexpectedly create conversations, generate notifications, or alter user-visible state.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The inline comment acknowledges that obtaining a chat ID may involve creating a chat, and the implementation proceeds with that side effect. In a messaging skill, hidden state-changing behavior is risky because operators may believe they are only reading history while actually performing a write action against external systems.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script performs `client.im.chat.create` to derive a `chat_id` before listing pins, which grants it message-creation side effects that are not necessary for a read-oriented utility. In practice, running this tool can create chats with arbitrary user IDs supplied on the command line, causing unintended interactions and expanding the operational permissions required beyond least privilege.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document explicitly advises against hardcoding secrets, but the troubleshooting example then shows a fixed app_id and instructs the user to place the app_secret directly in the request body. Even as an example, this encourages unsafe operator behavior, increases the chance secrets are pasted into shell history or docs, and normalizes credential exposure during debugging.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill advertises itself for '任何飞书开放平台API调用' ('any Feishu Open Platform API call'), which is an overly broad activation condition for a capability that can read, modify, upload, and message through a third-party SaaS. Broad triggers increase the chance the agent invokes this skill in situations where the user did not explicitly intend remote side effects, causing unnecessary data exposure or unauthorized modifications.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The examples include direct write/overwrite operations against remote Feishu documents without an explicit warning that these commands modify live remote content. In an agent setting, examples often become de facto operational guidance, so omitting a confirmation requirement can lead to accidental data loss, overwrites, or unauthorized edits.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code persists the Feishu tenant access token to a local JSON file on disk without any file permission hardening, encryption, or lifecycle controls. If the host, workspace, logs, backups, or shared filesystem are accessible to another user or process, the cached token can be recovered and used to make authenticated Feishu API calls until expiry.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents commands that can send audio messages and create group chats, both of which change external state in Feishu, but it does not warn users that these actions are side-effecting. In agentic or automated contexts, the lack of explicit warnings or confirmation guidance increases the risk of unintended message sending, unauthorized chat creation, spam, or accidental disclosure to the wrong recipients.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script retrieves message content from Feishu and prints it directly to stdout, which can expose sensitive chat data to terminal logs, shell history capture tooling, CI logs, or other users on shared systems. In a skill context, this is more dangerous because the tool is explicitly designed to access and reveal message contents, increasing the chance of unintended disclosure.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The script makes an authenticated Feishu API call and prints the entire response object to stdout. Full API responses can contain chat metadata, identifiers, member-related data, or other sensitive enterprise information, which may then be exposed in terminals, logs, CI output, or shared transcripts beyond the intended audience.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This code makes authenticated Feishu API calls to derive a P2P chat ID and enumerate pinned messages, then prints message summaries to stdout. In a skill context, that can expose private chat metadata and message content without any explicit consent flow, scope validation, or user disclosure, creating a real privacy and data-access risk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The document encourages parsing message contents and performing OCR on images, which can expose sensitive personal, business, or regulated data if users process messages without understanding the privacy implications. In a messaging integration context, this is more dangerous because the feature is explicitly designed to handle user communications and image content, increasing the likelihood of processing confidential information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The troubleshooting step tells the user to print the sensitive configuration file with cat, but does not warn that the file may contain credentials or secret references. In practice, this can leak secrets to terminal scrollback, logs, screen recordings, shell sharing tools, or copied support transcripts.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The manual token retrieval example includes an app_secret directly in the JSON body and provides no warning about secure handling. This can expose credentials through shell history, process inspection, copied terminal output, or documentation reuse, especially during troubleshooting under time pressure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script caches the Feishu tenant access token in /tmp, a globally shared location on multi-user systems. Because it does not set restrictive permissions, use a per-user runtime directory, or use secure temporary-file creation, another local user or process could read, replace, or race the cache file and steal or tamper with the token.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: reference-feishu-message/index.js:17

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: reference-feishu-message/send.js:23

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: reference-feishu-common/index.js:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: reference-feishu-message/get_latest_file.js:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: reference-feishu-message/get.js:7

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: reference-feishu-message/send-audio.js:10

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: reference-feishu-common/index.js:73

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: reference-feishu-message/get_latest_file.js:15

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: reference-feishu-message/get.js:14

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: reference-feishu-message/send-audio.js:23