Security audit
Security checks across malware telemetry and agentic risk
This skill does what it advertises, but it can send local files or screenshots to Feishu with broad triggers and inferred recipients without a required confirmation step.
Install only if you explicitly want the agent to send files through Feishu. Use a dedicated low-permission Feishu app, avoid storing the app secret broadly, and require the agent to confirm the exact file path, file size, platform, and recipient before every send, especially for screenshots or vague requests.
# 2. 上传文件
with open(file_path, 'rb') as f:
upload_resp = requests.post(
"https://open.feishu.cn/open-apis/im/v1/files",
headers={"Authorization": f"Bearer {token}"},
files={'file': (filename, f, mime_type)},file_key = upload_resp.json()["data"]["file_key"]
# 3. 发送文件消息
requests.post(
"https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
json={file_key = upload_resp.json()["data"]["file_key"]
# 3. 发送文件消息
requests.post(
"https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id",
headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
json={62/62 vendors flagged this skill as clean.
No suspicious patterns detected.