feishu-chatfile-skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a Feishu/Lark file-sending helper, but it needs review because it can automatically upload generated images and handles app secrets in exposed ways.

Install only if you are comfortable with an agent uploading selected local files or generated images to Feishu/Lark. Prefer changing the workflow to ask before each send, avoid passing app_secret on the command line, restrict what paths may be uploaded, and use least-privilege Feishu app permissions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_image.py:115

Finding

Application Secret Exposed Through Command-Line Arguments

Content

View full analysis

5 else "feishu" ``` `scripts/send_file.py:114-118`: ```python file_path = sys.argv[1] receive_id = sys.argv[2] app_id = sys.argv[3] app_secret = sys.argv[4] file_name = sys.argv[5] if len(sys.argv) > 5 else os.path.basename(file_path) ``` The usage instructions in `SKILL.md` likewise direct users to provide the application secret as a positional command-line argument: ```bash python3 skills/feishu-send-file/scripts/send_image.py [domain] ``` ```bash python3 skills/feishu-send-file/scripts/send_file.py [file_name] ``` ### Technical Analysis Both scripts accept the Feishu application secret through `sys.argv`. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history, captured by process monitoring and observability systems, included in diagnostic output, or exposed through operating-system process inspection to users with sufficient local visibility. The secret is legitimately required to obtain a tenant access token from the official Feishu or Lark authentication endpoint. The vulnerability is therefore not the transmission of the secret to that API, but its unnecessary exposure through the local process command line. No hardcoded secret was found, and the scripts do not intentionally print the secret. Nevertheless, command-line argument handling expands the credential's exposure surface beyond what the declared file-sending functional ...[truncated 1241 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:10

Finding

Mandatory Proactive Image Transmission Without Per-Transmission Consent

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

描述中强调“发送本地图片和文件技能”，并明确提到支持 JPEG/PNG/WEBP 等图片，采用官方推荐两步法确保内容在飞书客户端正常显示。实际代码虽然确实采用了上传后发送的两步流程，但调用的是 /im/v1/files 上传接口，并最终发送 msg_type='file' 的消息，返回/使用的是 file_key，而不是图片场景通常对应的 image 上传与 image 消息能力。因此，该实现与“发送文件”部分一致，但与“发送图片并正常显示为图片”的核心能力不一致。除此之外，代码访问的资源和主要用途仍集中在飞书消息发送，未发现额外恶意或无关能力。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code is narrowly focused on image sending. It validates an image path, retrieves a tenant access token, uploads the file via /im/v1/images with image_type=message, obtains an image_key, and sends a msg_type="image" message. It supports recipient IDs with ou_ and oc_ prefixes and can target Feishu or Lark domains, which aligns with part of the description. However, the declared purpose explicitly says the skill sends both local images and files, including formats like PDF/HTML/ZIP, using the two-step official method. No file upload endpoint, file key handling, or msg_type for file messages exists in this code chunk. Therefore the description materially overstates the implemented capability, making it a mismatch.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Step 1 - 上传文件：

bash

TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

-H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_type=stream" \
  -F "file_name=<文件名>" \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares shell and network-capable behavior but does not scope or restrict those capabilities via explicit permissions or allowed-tools metadata. That increases the chance an agent can invoke broader-than-necessary operations, including credential access and outbound transmission, which is risky in a skill designed to handle local files and secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill mandates proactive sending of generated files/images to the current Feishu chat without requiring a fresh, explicit user confirmation at transmission time. That weakens user control over external sharing and raises the risk of accidental leakage of sensitive locally generated content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs reading Feishu app credentials from a global configuration file, which expands its effective capability from file sending to secret retrieval. In an agent environment, this creates a clear path for unnecessary access to sensitive credentials that could be exfiltrated, reused, or logged during task execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions describe obtaining credentials and uploading local content to Feishu but omit a clear disclosure that both secrets and file contents are being transmitted to an external service. In practice, this can cause operators or agents to perform sensitive outbound actions without adequate informed consent or handling safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This command sends app_id and app_secret to Feishu to obtain an access token, which is expected for the integration but still constitutes external transmission of sensitive credentials. In a skill context, this is security-relevant because the operation uses secrets and relies on outbound network access that should be tightly controlled and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Step 1 - 上传文件：

bash

TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This step transmits message content and a file reference to Feishu, creating an external data-sharing channel from the local environment to a third-party service. The behavior is the core purpose of the skill, but it is still a real security concern because local artifacts may contain sensitive information and are sent outside the host boundary.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Step 2 - 发送消息：

bash

curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"<OPEN_ID>\",\"msg_type\":\"file\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_file.py (reported line 37)May include surrounding context.

python

def upload_file(token, file_path, file_name):
    """上传文件到飞书，返回 file_key"""
    import subprocess
    result = subprocess.run([
        "curl", "-s", "-X", "POST",
        "https://open.feishu.cn/open-apis/im/v1/files",
        "-H", f"Authorization: Bearer {token}",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code performs a safety-relevant action by transmitting a user-supplied local file and message metadata to remote Feishu endpoints. Although the script prints progress messages, it does not provide any explicit warning or confirmation that local file contents will be uploaded off-system before performing the action.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings entirely in Chinese in the module docstring and later user-visible output, with no indication that the skill is region-specific or that another language can be selected. That creates a language/locale policy issue under the requirement to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_image.py (reported line 42)May include surrounding context.

python

def upload_image(base: str, token: str, image_path: str) -> str:
    result = subprocess.run([
        "curl", "-sS", "-X", "POST",
        f"{base}/open-apis/im/v1/images",
        "-H", f"Authorization: Bearer {token}",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code consumes app_id and app_secret from command-line arguments and sends them to an authentication endpoint, which is a sensitive credential-handling operation. The usage text explains required arguments but does not warn users that secrets are being passed via CLI, where they may be exposed in shell history or process listings.

Content

No source excerpt is available for this finding.