Feishu Webhook

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Anything the user or agent passes into the script may be posted to a Feishu channel or DM.

Why it was flagged

The script sends all provided stdin content to the configured Feishu webhook. This is the intended function, but it is an external message/data flow.

Skill content

content = sys.stdin.read().strip() ... conn.request("POST", u.path, json.dumps(payload, ensure_ascii=False).encode(), {"Content-Type": "application/json"})

Recommendation

Only send content intended for that Feishu destination, and avoid including secrets or private data unless the channel is appropriate.

Note

ASI03: Identity and Privilege Abuse

What this means

Whoever can use the configured environment can post messages through that Feishu bot/webhook.

Why it was flagged

The skill documents use of a webhook URL and secret, and the code reads them from environment variables. These credentials are expected for Feishu webhook posting, though the registry metadata lists no required env vars or primary credential.

Skill content

"FEISHU_WEBHOOK_URL": "https://open.feishu.cn/open-apis/bot/v2/hook/xxx", "FEISHU_WEBHOOK_SECRET": "your_secret"

Recommendation

Configure a least-privilege Feishu webhook, protect the webhook URL and secret, and rotate them if they are exposed.