Feishu Webhook

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:36 AM UTC
• Version: 1.2.4

Overview

This skill does what it claims: it sends user-provided Markdown content to a configured Feishu webhook.

Install only if you intend agents to post selected message content to Feishu. Do not pipe secrets, credentials, private logs, or internal reports into it unless sharing them with the configured Feishu destination is intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection

Content

# Feishu Webhook Skill

Send messages to Feishu via Webhook with heredoc input.

## Quick Start

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README instructs users to pipe arbitrary Markdown content into a script that sends it to a Feishu webhook, but it does not explicitly warn that the content will be transmitted to an external third-party service. In an agent/skill ecosystem, users may pass sensitive reports, logs, or prompts via heredoc without realizing this creates data egress, which can lead to unintended disclosure of confidential information.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires access to environment variables and network connectivity to send data to a Feishu webhook, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: users and orchestration systems are not clearly informed that the skill can read configured secrets and transmit content externally.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to pipe arbitrary Markdown content into a script that posts to Feishu, but it never prominently warns that supplied content leaves the local environment and is transmitted to an external service. This omission increases the risk of accidental exfiltration of sensitive notes, reports, credentials, or agent-generated data.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
python3 /home/yuhiri/workspace/skills/feishu-webhook/scripts/send-feishu.py << 'EOF'
# Write your Markdown content here (avoid level 1 and 2 headings; levels 3-6 are acceptable)
- Lists
- **Bold text**
EOF

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script silently consumes webhook credentials from environment variables without clearly disclosing that behavior to the user at runtime or in the visible interface. In agent environments, undisclosed credential consumption can surprise operators and makes it easier to route data using ambient secrets the user did not realize the skill would access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script reads arbitrary stdin content and posts it directly to an external Feishu webhook, but it provides no explicit warning, confirmation, destination display, or data-classification guardrail before transmission. In an agent setting, that creates a real exfiltration risk because sensitive prompts, reports, tokens, or internal output could be forwarded off-system with a single invocation.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: The manifest frames this as a message-sending utility with heredoc input support, but the implementation also depends on environment-based credential/configuration access. While common in practice, reading secrets from environment variables is an additional capability not mentioned in the stated scope.

Static analysis

No suspicious patterns detected.