Security audit
Security checks for vulnerabilities and agentic risk
The skill has a legitimate file-sending purpose, but it should be reviewed because it directs agents to read and pass Feishu app secrets directly while sending local files externally.
Review before installing. Use this only with explicitly chosen files and recipients, avoid letting the agent discover or print Feishu secrets from local config files, and prefer secure secret injection over command-line app_secret arguments. Treat any callback_url use as unsafe unless the destination and payload are clearly explained.
The skill documents a callback_url input without explaining what data may be sent to it or imposing any restrictions. In an agent context, this can enable silent transmission of execution results, metadata, or file-handling outcomes to an arbitrary external endpoint supplied by a user or prompt, creating an SSRF/data-exfiltration risk surface.
The documentation instructs the agent to read /root/.skill-platform/skill-platform.json and extract appId/appSecret from a local credential store. That expands the skill from file sending into credential discovery, encouraging access to sensitive secrets unrelated to the immediate user-provided file operation and increasing the chance of credential exposure through terminal history, logs, or downstream prompts.
The document says secrets should be protected, but its examples pass app_secret on the command line and show extracting it from config files. Command-line arguments are commonly exposed via shell history, process listings, audit logs, and debugging output, so this guidance materially increases secret leakage risk.
The skill normalizes direct handling of Feishu app credentials in examples and operational instructions without strong user-facing safeguards. In this context, the skill is designed to send local files to an external service, so encouraging direct disclosure and reuse of app credentials heightens the risk of account compromise and unauthorized outbound messaging if those secrets are captured or reused.
A callback_url parameter implies outbound delivery of execution results or metadata to a third-party endpoint, but the document provides no warning, validation rules, or privacy constraints. In a skill that already supports file-related operations and external API communication, this omission makes unintended data disclosure more likely.
The skill explicitly uploads local files to Feishu via external HTTP requests. External transmission is expected for a file-sending skill, but it is still security-relevant because local paths such as /root/myfiles and arbitrary selected content may be exfiltrated off-host if the agent is induced to send sensitive files or if destination/recipient parameters are attacker-controlled.
-d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}' \
| python3 -c "import json,sys; print(json.load(sys.stdin)['app_access_token'])")
# ...
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
-H "Authorization: Bearer $TOKEN" \
-F "file_type=stream" \
-F "file_name=<文件名>" \