Feishu Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:55 AM UTC
• Version: 1.0.0

Overview

This Feishu skill matches its stated purpose, but it asks users to install a powerful third-party CLI through an unverified remote shell script and then use it for sensitive workspace actions.

Review this carefully before installing. Prefer a pinned release with checksum or signature verification instead of the recommended curl-to-bash command, configure Feishu credentials only after verifying the CLI, grant the minimum Feishu app scopes needed, and require explicit confirmation for exports, writes, message sends, calendar/task creation, and permission changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unverified Remote Installation Script Executed Through Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

bash

# One-click installation (recommended)
curl -fsSL https://raw.githubusercontent.com/riba2534/feishu-cli/main/install.sh | bash

Technical Analysis

The recommended installation command downloads a shell script from a personal GitHub repository and pipes the response directly into bash. The URL references the mutable main branch rather than an immutable commit or verified release. Consequently, the executed payload can change after the Skill has been audited.

No cryptographic checksum, digital signature, pinned revision, or inspection step is required before execution. Although HTTPS protects the connection in transit, it does not establish that future repository content is safe. Compromise of the maintainer account or repository, or a malicious upstream modification, could therefore turn this command into arbitrary code execution.

This behavior is not necessary at the privilege level shown. The declared Feishu functionality requires a CLI, but it does not require executing an unreviewed remote response directly. A pinned and integrity-verified release artifact would satisfy the same functional requirement with substantially less supply-chain risk.

Attack Path

1. An Agent activates the Skill for a Feishu-related task.
2. The user or Agent follows the documented, recommended installation command.
3. An attacker compromises the upstream repository or maintainer account, or otherwise causes malicious content to be served from the referenced mutable branch.
4. curl retrieves the modified install.sh response.
5. The shell pipe passes that response directly to bash without local review or integrity verification.
6. The malicious script executes arbitrary commands with the permissions of the invoking account.
7. The pay ...[truncated 1090 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash installation path.

2. Pin installation assets to a reviewed version and immutable commit or release.

3. Publish SHA-256 checksums or cryptographic signatures through a trusted channel and verify them before execution.

4. Download the installer to a local file, validate its integrity, and permit inspection before running it.

5. Prefer an official package registry or a verified, organization-controlled distribution source.

6. Run installation without administrative privileges unless a documented installation step strictly requires them.

7. Do not expose Feishu secrets to the installer process. Configure credentials only after installation and verification.

8. Document the minimum Feishu API scopes required for each command and recommend separate, least-privilege credentials.

9. Provide reproducible build information or source-to-binary provenance for downloaded executables.

10. Replace the command with an integrity-verifying workflow, for example:

    bash

    curl -fL -o feishu-cli.tar.gz \
      "https://github.com/riba2534/feishu-cli/releases/download/<PINNED_VERSION>/<PLATFORM_ARCHIVE>"
    echo "<PUBLISHED_SHA256>  feishu-cli.tar.gz" | sha256sum --check -
    

    Extraction and installation should occur only after checksum or signature validation succeeds.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping remotely fetched content straight into bash creates a direct code-execution chain with no inspection or integrity validation. In an agent-driven setup, this is especially risky because it enables one-step execution of untrusted code that could install persistence, steal secrets such as Feishu credentials, or tamper with the environment.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

1. 安装

bash

# 一键安装（推荐）
curl -fsSL https://raw.githubusercontent.com/riba2534/feishu-cli/main/install.sh | bash

# 手动下载安装（安装脚本403时使用）
# 访问 https://github.com/riba2534/feishu-cli/releases 下载对应平台版本

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs use of a third-party CLI to read, write, export, message, and manage permissions in Feishu, but it does not warn users about credential exposure, remote data transmission, or the consequences of destructive or permission-changing operations. In an agent context, this omission can cause users to authorize sensitive actions without informed consent, increasing the risk of unintended disclosure or modification of enterprise data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says agents should '优先使用feishu-cli' and in some cases '必须使用feishu-cli', which removes user choice and can push actions through a specific external tool without explicit opt-in. In a security-sensitive environment, forced tool selection increases the chance of unnecessary credential use, unintended data transfer, and execution of higher-risk workflows when safer built-in alternatives may exist.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends fetching and executing an installation script directly from a remote GitHub URL. This is dangerous because the downloaded content is not pinned, verified, or reviewed locally, so compromise of the repository, branch, or delivery path could lead to arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

1. 安装

bash

# 一键安装（推荐）
curl -fsSL https://raw.githubusercontent.com/riba2534/feishu-cli/main/install.sh | bash

# 手动下载安装（安装脚本403时使用）
# 访问 https://github.com/riba2534/feishu-cli/releases 下载对应平台版本

Static analysis

No suspicious patterns detected.