Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its stated marketing workflow, but its upload methods can send arbitrary readable local files to Feishu or Slack if misused.
Review before installing. Use it only in a workspace where generated marketing assets are safe to share with the configured Feishu folder and Slack channel, avoid passing arbitrary file paths to the upload methods, and prefer pinned dependencies plus explicit upload confirmation or path restrictions.
marketing_asset_workflow.py:114Unrestricted Local File Upload to Feishu and Slack
requirements.txt:1Unpinned and Unverified Third-Party Dependencies
The documented purpose omits behaviors detected by analysis: saving generated files locally and uploading them directly to Slack as attachments. Undisclosed file persistence and secondary data sharing are dangerous because users may assume assets exist only in memory or only in Feishu, while sensitive prompts, generated content, or embedded metadata may be retained locally or propagated more widely than expected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
return []
def _get_feishu_token(self):
"""Get Feishu tenant access token"""
url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
payload = {
"app_id": self.feishu_app_id,
The workflow automatically uploads generated assets to Feishu Drive and sends details to Slack without explicit user confirmation at the time of transmission. If prompts or generated assets contain confidential marketing plans, embargoed content, or regulated data, this causes unintended disclosure to third-party services and broader audiences.
File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
"Content-Type": multi_form.content_type
}
response = requests.post(upload_url, headers=headers, data=multi_form)
response.raise_for_status()
result = response.json()["data"]
The README explicitly advertises automatic upload to Feishu Drive and Slack notifications, but it does not warn users that prompts, generated assets, filenames, links, or related metadata may be transmitted to third-party services. In an AI workflow handling potentially sensitive marketing materials, this omission can cause users to unintentionally exfiltrate confidential campaign content outside their local environment or approved boundary.
The skill advertises network access and use of multiple secrets via environment variables, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the effective trust boundary unclear and can lead to overbroad execution in agent environments, especially because the workflow can exfiltrate generated content and related context to external services.
The skill description does not clearly warn that generated assets and related context are automatically uploaded to Feishu Drive and shared via Slack. In a marketing workflow this may be expected at a high level, but the lack of an explicit disclosure increases the risk that users include confidential prompts, unreleased campaign material, or internal references that are then automatically transmitted to third-party systems.
Generated images are silently written to local disk without notice, which can leave sensitive or unexpected artifacts on the host. In an agent/workflow context, users may assume outputs are ephemeral; persistent file creation can expose data to other local users, backup systems, or later automation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.feishu_app_id,
"app_secret": self.feishu_app_secret
}
response = requests.post(url, json=payload)
response.raise_for_status()
return response.json()["tenant_access_token"]
The dependency is specified with a minimum version only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or breaking releases through the supply chain.
python-dotenv>=1.0.0
duckduckgo-search>=6.1.0
google-genai>=0.3.0
requests>=2.31.0
The manifest does not pin python-dotenv, so it is impossible to verify whether the installed version includes known vulnerable releases. While this file alone does not prove exploitation, the combination of an advisory-bearing package and non-deterministic version selection creates avoidable supply-chain risk.
Using an unpinned version for duckduckgo-search means builds are not reproducible and later installations may pull in unexpected code changes. This increases supply-chain risk, even if no specific exploit is evident from this file alone.
python-dotenv>=1.0.0
duckduckgo-search>=6.1.0
google-genai>=0.3.0
requests>=2.31.0
requests-toolbelt>=1.0.0
The google-genai package is not pinned to a specific release, so the deployed dependency can vary between installations. In a workflow that interfaces with external AI services, this can introduce unreviewed behavior changes or newly introduced vulnerable code.
python-dotenv>=1.0.0
duckduckgo-search>=6.1.0
google-genai>=0.3.0
requests>=2.31.0
requests-toolbelt>=1.0.0
slack-sdk>=3.27.0
Requests is unpinned despite being a security-sensitive HTTP client library with a history of advisories. In this skill, it likely handles external network communication to cloud and messaging services, so resolving to an affected version could expose credential leakage, TLS, or request-handling issues.
python-dotenv>=1.0.0
duckduckgo-search>=6.1.0
google-genai>=0.3.0
requests>=2.31.0
requests-toolbelt>=1.0.0
slack-sdk>=3.27.0
Requests has multiple historical advisories, and because the version is not pinned, the actual installed release cannot be verified as safe. Given this skill's likely reliance on outbound HTTP for cloud storage, search, image generation, and notifications, an affected requests version could have meaningful security impact.
Requests-toolbelt is unpinned, allowing dependency drift and reducing build determinism. Because it extends HTTP request handling, unexpected upstream changes can affect how data is uploaded or transmitted to third-party services.
duckduckgo-search>=6.1.0
google-genai>=0.3.0
requests>=2.31.0
requests-toolbelt>=1.0.0
slack-sdk>=3.27.0
Slack SDK is unpinned, so future installs may pull in unreviewed releases that interact with Slack APIs and tokens differently. In a notification workflow, dependency drift in a privileged API client increases the risk of token misuse, data exposure, or operational breakage.
google-genai>=0.3.0
requests>=2.31.0
requests-toolbelt>=1.0.0
slack-sdk>=3.27.0
No suspicious patterns detected.