Auwomo Message

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.0.0

Overview

The skill does what it says by sending Feishu messages, but its broad triggers and unsafe shell-style command examples create meaningful risk of accidental sends or command injection.

Install only if you are comfortable with this skill sending real Feishu private messages through an existing auwomo/lark-cli setup. Agents should use dry-run first, require clear recipient and message confirmation before sending, and invoke the CLI with structured arguments rather than interpolating message text into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Command Injection Through Shell-Interpolated Message Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-50; references/message-send.md:20-28,38-40,67-69
Vulnerability Type: OS command injection caused by unsafe shell interpolation
Risk Level: High

Vulnerable Code

SKILL.md:48-50:

markdown

| Send message | `auwomo message send --to "recipient" --text "content"` |
| Preview without sending | `auwomo message send --to "recipient" --text "content" --dry-run` |
| Send by open_id | `auwomo message send --to ou_xxx --text "content"` |

references/message-send.md:20-28:

bash

auwomo message send --to "recipient" --text "Please complete today's daily report before leaving work." --dry-run

The dry-run output displays the command that would be executed without actually sending it.

3. Send the Message

bash

auwomo message send --to "recipient" --text "Please complete today's daily report before leaving work."

references/message-send.md:38-40:

bash

auwomo message send --to "recipient" --text "hello" --format json

references/message-send.md:67-69:

bash

auwomo message send --to "recipient-one" --text "Please submit the daily report"
auwomo message send --to "recipient-two" --text "Please submit the daily report"

Technical Analysis

The skill directs an agent to insert user-supplied recipient identifiers and message bodies into shell command strings enclosed with double quotes. Double quotes do not neutralize all shell syntax. Command substitution using $(...) or backticks remains active inside double-quoted strings, and an embedded quote can terminate the intended argument and introduce additional shell operators.

For example, if an implementation directly constructs and executes the documented command through a shell, a message containing:

text

Status update $(id > /tmp/agent-identity)

could cause the shell to execute id before invoking auwomo. The --dry-run ...[truncated 2274 chars]

Remediation

View remediation

Remediation Suggestions

1. Require execution through a structured process API that accepts an argument array and does not invoke a shell. The intended arguments should be equivalent to:

   text

   ["auwomo", "message", "send", "--to", recipient, "--text", message]
   

   Add "--dry-run" or "--format", "json" as separate arguments when needed.

2. Explicitly prohibit shell-string execution, including sh -c, bash -c, eval, and process APIs configured with shell=true.

3. Update every command example to state that placeholders represent separate process arguments rather than text to be interpolated into a shell command.

4. Validate recipients using the documented exact-match policy and validate direct open_id values against the expected identifier format.

5. Treat message text as opaque data. Do not remove ordinary message punctuation merely as a substitute for safe process invocation.

6. If a shell is unavoidable, apply a well-tested, platform-specific argument-quoting routine to every dynamic value. Manual wrapping with single or double quotes is insufficient.

7. Add security tests using message bodies containing command substitutions, backticks, quotes, semicolons, newlines, redirection operators, and other shell metacharacters. Confirm that these values arrive at auwomo literally and do not create local side effects.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes very generic terms such as "message", "send", "notify", and common Chinese verbs like "发给", which can appear in many unrelated conversations. This can cause unintended skill activation and lead the agent to send messages when the user did not explicitly intend to invoke this messaging capability, creating a real risk of accidental outbound communication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples are broad enough to match ordinary conversational phrases such as '通知', '提醒', or '发给 xxx', which can cause the messaging skill to activate when the user did not explicitly intend to send a direct message. In a skill that performs real outbound communication to organization members, accidental invocation can lead to unintended message delivery, privacy issues, or disruptive spam inside the organization.

Content

No source excerpt is available for this finding.