Security audit

feishu-video

Security checks for vulnerabilities and agentic risk

Overview

The voice-message skill mostly matches its stated Feishu purpose, but it needs Review because it includes underdeclared video-sending capability and unsafe app-secret handling examples.

Install only after reviewing whether you want this package to support video as well as audio. Use least-privilege Feishu app scopes, avoid passing app secrets as command-line arguments, prefer a secret manager or carefully controlled environment variables, and treat any selected media file as uploaded to Feishu/Lark. If you only need voice messages, remove or ignore the video script and documentation before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send-voice.mjs:20
Finding: Feishu app secret exposed through command-line arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/send-video.mjs:169
Finding: Temporary video covers and segments are not reliably deleted after failures
Content: View full analysis
name.endsWith('.mp4')) .sort() .map(name => path.join(tempDir, name)); return { segments, tempDir }; ``` Cleanup occurs only on successful control paths at `scripts/send-video.mjs:327-351`: ```javascript if (!SKIP_COVER) { try { const coverPath = extractCoverImage(segmentPath); imageKey = await uploadCoverImage(token, coverPath); fs.rmSync(path.dirname(coverPath), { recursive: true, force: true }); } catch (error) { console.warn(`⚠️ ${segmentLabel}Failed to generate cover image, sending without cover`); console.warn(` ${error.message}`); } } await sendVideoMessage(token, fileKey, imageKey); if (segmentTempDir) { fs.rmSync(segmentTempDir, { recursive: true, force: true }); } ``` ### Technical Analysis Temporary file ...[truncated 2034 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 105)May include surrounding context.
md
| Endpoint | Description | |----------|-------------| | `/auth/v3/tenant_access_token/internal` | Get access token | | `/im/v1/files` | Upload audio file | | `/im/v1/messages` | Send voice message |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
API Details

1. Get Tenant Access Token

text
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
API Details

1. Get Tenant Access Token

text
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/send-video.mjs (reported line 116)May include surrounding context.
js
## API Details ### 1. Get Tenant Access Token ``` POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal ```

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/send-video.mjs (reported line 134)May include surrounding context.
js
## API Details ### 1. Get Tenant Access Token ``` POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal ```

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/send-voice.mjs (reported line 96)May include surrounding context.
js
## API Details ### 1. Get Tenant Access Token ``` POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal ```

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/send-voice.mjs (reported line 114)May include surrounding context.
js
## API Details ### 1. Get Tenant Access Token ``` POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal ```

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file implements video-message sending even though the skill is described and scoped as an audio/voice messaging skill. This capability mismatch is dangerous because it expands the skill's effective permissions and data-handling behavior beyond what a reviewer or user would reasonably expect, enabling covert or unauthorized media exfiltration under misleading packaging.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest states the skill is for sending voice/audio messages to Feishu users, and the README repeatedly frames the skill as voice-message focused. However, the documented commands include a separate send-video.mjs flow for sending video messages, which expands the behavior beyond the declared audio-only scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documentation instructs users to upload and send audio/video content to Feishu APIs but does not clearly warn that user-provided media will leave the local environment and be transmitted to a third-party service. In an agent setting, this can cause accidental disclosure of sensitive recordings or videos if the user does not realize external transfer occurs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents use of environment variables and outbound network calls to Feishu APIs, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance that an agent or user invokes the skill without clear awareness that secrets will be read from the environment and data will be transmitted externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to provide Feishu app credentials and upload audio content to Feishu, but it does not warn that credentials and user audio will leave the local environment and be sent to a third-party service. This can lead to accidental disclosure of sensitive voice content or misuse of app secrets by users who do not realize the privacy implications.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The segmentation, cover extraction, upload, and send workflow introduces substantial video-processing capability that is unjustified for an audio-only skill. Even if the code uses legitimate Feishu APIs, the hidden expansion of media handling increases attack surface and creates a trust-boundary violation between declared purpose and actual behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send-video.mjs (reported line 191)May include surrounding context.
js
formData.append('image_type', 'message'); formData.append('image', new Blob([coverBuffer]), 'cover.jpg'); const response = await fetch('https://open.feishu.cn/open-apis/im/v1/images', { method: 'POST', headers: { 'Authorization': `Bearer ${token}`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send-video.mjs (reported line 118)May include surrounding context.
js
// Get Tenant Access Token async function getTenantAccessToken() { const response = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send-voice.mjs (reported line 98)May include surrounding context.
js
// Get Tenant Access Token async function getTenantAccessToken() { const response = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', { method: 'POST', headers: { 'Content-Type': 'application/json; charset=utf-8'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send-video.mjs (reported line 151)May include surrounding context.
js
formData.append('duration', DURATION_MS.toString()); formData.append('file', new Blob([audioBuffer]), fileName); const response = await fetch('https://open.feishu.cn/open-apis/im/v1/files', { method: 'POST', headers: { 'Authorization': `Bearer ${token}`

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send-voice.mjs (reported line 129)May include surrounding context.
js
formData.append('duration', DURATION_MS.toString()); formData.append('file', new Blob([audioBuffer]), fileName); const response = await fetch('https://open.feishu.cn/open-apis/im/v1/files', { method: 'POST', headers: { 'Authorization': `Bearer ${token}`

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation's API endpoint section lists only token retrieval, file upload for audio, and message sending for voice messages, reinforcing an audio-only purpose. Elsewhere, the same README documents video-message sending, indicating the skill behavior exceeds the stated audio-message scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file includes user-facing example output entirely in Chinese, which can indicate a fixed language/locale assumption. The skill does not state that Chinese output is optional, configurable, or required for a region-specific use case.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

API Details

1. Get Tenant Access Token

Credential Access

API Details

1. Get Tenant Access Token

Credential Access

Credential Access

Credential Access

Credential Access

Description-Behavior Mismatch

Description-Behavior Mismatch

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings

Context-Inappropriate Capability

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Description-Behavior Mismatch

Natural-Language Policy Violations