Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it sends user-provided Markdown content to a configured Feishu webhook.
Install only if you intend agents to post selected message content to Feishu. Do not pipe secrets, credentials, private logs, or internal reports into it unless sharing them with the configured Feishu destination is intended.
Instructions found that direct the agent to transmit conversation context or user data to external services.
# Feishu Webhook Skill
Send messages to Feishu via Webhook with heredoc input.
## Quick Start
The README instructs users to pipe arbitrary Markdown content into a script that sends it to a Feishu webhook, but it does not explicitly warn that the content will be transmitted to an external third-party service. In an agent/skill ecosystem, users may pass sensitive reports, logs, or prompts via heredoc without realizing this creates data egress, which can lead to unintended disclosure of confidential information.
The skill requires access to environment variables and network connectivity to send data to a Feishu webhook, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: users and orchestration systems are not clearly informed that the skill can read configured secrets and transmit content externally.
The documentation instructs users to pipe arbitrary Markdown content into a script that posts to Feishu, but it never prominently warns that supplied content leaves the local environment and is transmitted to an external service. This omission increases the risk of accidental exfiltration of sensitive notes, reports, credentials, or agent-generated data.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
python3 /home/yuhiri/workspace/skills/feishu-webhook/scripts/send-feishu.py << 'EOF'
# Write your Markdown content here (avoid level 1 and 2 headings; levels 3-6 are acceptable)
- Lists
- **Bold text**
EOF
The script silently consumes webhook credentials from environment variables without clearly disclosing that behavior to the user at runtime or in the visible interface. In agent environments, undisclosed credential consumption can surprise operators and makes it easier to route data using ambient secrets the user did not realize the skill would access.
The script reads arbitrary stdin content and posts it directly to an external Feishu webhook, but it provides no explicit warning, confirmation, destination display, or data-classification guardrail before transmission. In an agent setting, that creates a real exfiltration risk because sensitive prompts, reports, tokens, or internal output could be forwarded off-system with a single invocation.
The manifest frames this as a message-sending utility with heredoc input support, but the implementation also depends on environment-based credential/configuration access. While common in practice, reading secrets from environment variables is an additional capability not mentioned in the stated scope.
No suspicious patterns detected.