Feishu Sender

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:43 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Feishu/Lark sender that uses configured credentials to send user-provided text, files, and images to Feishu, with no hidden persistence or deceptive behavior found.

Install only if you intend Codex or scripts to send selected text, images, and local files to Feishu/Lark using your app credentials. Keep the Feishu app secret in a trusted environment file, avoid passing untrusted --env paths, verify the destination chat ID before sending sensitive material, and do not send secrets or private files unless that disclosure is intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The method accepts an arbitrary env_file path and parses it into process environment variables without trust validation or safe parsing. In an agent context, this can expose a broader local-file access primitive and allow untrusted workflow input to influence credential loading or override environment configuration from attacker-chosen files.

Content

Scanner excerpt · feishu_sender.py (reported line 42)May include surrounding context.

python

@classmethod
    def from_env(cls, env_file: Optional[str] = None) -> "FeishuConfig":
        """从环境变量或 .env 文件加载配置"""
        if env_file and os.path.exists(env_file):
            with open(env_file) as f:
                for line in f:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill requires environment secrets and performs outbound network actions, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens governance and reviewability, making it easier for an agent or operator to invoke secret-backed external communication without clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description says it can send messages and files to Feishu, but it omits a clear warning that any provided content and files will be transmitted to an external chat using configured credentials. In an agent setting, this creates a real risk of unintentional data exfiltration of sensitive prompts, reports, or local files because users may not realize the trust boundary change.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · feishu_sender.py (reported line 122)May include surrounding context.

python

}
        
        try:
            response = requests.post(url, json=payload, timeout=10)
            response.raise_for_status()
            data = response.json()

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · feishu_sender.py (reported line 164)May include surrounding context.

python

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · feishu_sender.py (reported line 203)May include surrounding context.

python

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · feishu_sender.py (reported line 364)May include surrounding context.

python

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill is explicitly designed to transmit local files and message content to an external third-party service, but the API provides no consent checkpoint, allowlist, or explicit warning before exfiltrating potentially sensitive local data. In an agent context, this increases risk because higher-level workflows may pass sensitive paths or report contents into send_file/send_text without the user's informed approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This request transmits arbitrary message content to an external service, which is the intended purpose of the skill but still represents a real exfiltration surface in an agent environment. The danger is contextual: when invoked by other tools or prompts, the skill can send sensitive text to attacker-chosen recipients if no higher-level authorization or destination restrictions exist.

Content

Scanner excerpt · feishu_sender.py (reported line 249)May include surrounding context.

python

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This path sends uploaded local files to Feishu and therefore can exfiltrate arbitrary filesystem content accessible to the process. In a skill context, that is more dangerous than ordinary application behavior because an agent could be induced to send confidential documents, source code, tokens, or reports to an external chat without sufficient user awareness.

Content

Scanner excerpt · feishu_sender.py (reported line 299)May include surrounding context.

python

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This endpoint sends image content externally, creating another exfiltration channel for local data. In an agent setting, screenshots, diagrams, or photos may contain sensitive information, and the method accepts arbitrary local paths with no policy guardrails.

Content

Scanner excerpt · feishu_sender.py (reported line 414)May include surrounding context.

python

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The docstring at L429-L430 and comment at L437/L450 state that this method sends Markdown-formatted content and that Feishu will render markdown. However, the payload built at L451-L461 places the input into a text tag ({"tag": "text", "text": content}), which does not implement Markdown parsing/rendering semantics and instead sends the raw content as text within a post message.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The message payload for send_markdown always uses the zh_cn locale key, which enforces a specific language/locale behavior regardless of user preference. The file does not offer locale selection or explain that the skill is intentionally limited to a China-specific context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This markdown/post send path also transmits user-provided content to Feishu, so it is an external data-transfer primitive. The risk is not from the HTTP call itself but from the absence of guardrails preventing sensitive or unapproved content from being sent to external recipients in an agent workflow.

Content

Scanner excerpt · feishu_sender.py (reported line 466)May include surrounding context.

python

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The main descriptive sentence for the skill is presented in Chinese, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The configuration loader reads FEISHU_APP_ID and FEISHU_APP_SECRET from the environment, which is access to sensitive authentication material. While the code does not print the secret, there is no explicit disclosure to users that the skill depends on and consumes stored credentials for external messaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code file contains user-facing natural language such as the module docstring, argument descriptions, and examples primarily in Chinese. The skill does not indicate that Chinese is optional, user-selectable, or required for a region-specific purpose, which can violate a language/locale policy requiring neutrality or user choice.

Content

No source excerpt is available for this finding.