Feishu Sender

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:43 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Feishu/Lark sender that uses configured credentials to send user-provided text, files, and images to Feishu, with no hidden persistence or deceptive behavior found.

Install only if you intend Codex or scripts to send selected text, images, and local files to Feishu/Lark using your app credentials. Keep the Feishu app secret in a trusted environment file, avoid passing untrusted --env paths, verify the destination chat ID before sending sensitive material, and do not send secrets or private files unless that disclosure is intended.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

@classmethod
    def from_env(cls, env_file: Optional[str] = None) -> "FeishuConfig":
        """从环境变量或 .env 文件加载配置"""
        if env_file and os.path.exists(env_file):
            with open(env_file) as f:
                for line in f:

• Confidence: 76% confidence
• Finding: The method accepts an arbitrary `env_file` path and parses it into process environment variables without trust validation or safe parsing. In an agent context, this can expose a broader local-file access primitive and allow untrusted workflow input to influence credential loading or override environment configuration from attacker-chosen files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill requires environment secrets and performs outbound network actions, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens governance and reviewability, making it easier for an agent or operator to invoke secret-backed external communication without clear policy boundaries.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill description says it can send messages and files to Feishu, but it omits a clear warning that any provided content and files will be transmitted to an external chat using configured credentials. In an agent setting, this creates a real risk of unintentional data exfiltration of sensitive prompts, reports, or local files because users may not realize the trust boundary change.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
        
        try:
            response = requests.post(url, json=payload, timeout=10)
            response.raise_for_status()
            data = response.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'data' from requests.post (line 124, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

files = {'image': (image_path.name, f)}
            data = {'image_type': 'message'}  # message: 用于发送消息
            
            response = requests.post(url, headers=headers, files=files, data=data, timeout=60)
            response.raise_for_status()
            
            result = response.json()

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill is explicitly designed to transmit local files and message content to an external third-party service, but the API provides no consent checkpoint, allowlist, or explicit warning before exfiltrating potentially sensitive local data. In an agent context, this increases risk because higher-level workflows may pass sensitive paths or report contents into `send_file`/`send_text` without the user's informed approval.

External Transmission

Medium

• Category: Data Exfiltration

Content

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

• Confidence: 84% confidence
• Finding: This request transmits arbitrary message content to an external service, which is the intended purpose of the skill but still represents a real exfiltration surface in an agent environment. The danger is contextual: when invoked by other tools or prompts, the skill can send sensitive text to attacker-chosen recipients if no higher-level authorization or destination restrictions exist.

External Transmission

Medium

• Category: Data Exfiltration

Content

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

• Confidence: 87% confidence
• Finding: This path sends uploaded local files to Feishu and therefore can exfiltrate arbitrary filesystem content accessible to the process. In a skill context, that is more dangerous than ordinary application behavior because an agent could be induced to send confidential documents, source code, tokens, or reports to an external chat without sufficient user awareness.

External Transmission

Medium

• Category: Data Exfiltration

Content

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

• Confidence: 83% confidence
• Finding: This endpoint sends image content externally, creating another exfiltration channel for local data. In an agent setting, screenshots, diagrams, or photos may contain sensitive information, and the method accepts arbitrary local paths with no policy guardrails.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The docstring at L429-L430 and comment at L437/L450 state that this method sends Markdown-formatted content and that Feishu will render markdown. However, the payload built at L451-L461 places the input into a text tag (`{"tag": "text", "text": content}`), which does not implement Markdown parsing/rendering semantics and instead sends the raw content as text within a post message.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The message payload for send_markdown always uses the zh_cn locale key, which enforces a specific language/locale behavior regardless of user preference. The file does not offer locale selection or explain that the skill is intentionally limited to a China-specific context.

External Transmission

Medium

• Category: Data Exfiltration

Content

params = {"receive_id_type": receive_id_type}
        
        response = requests.post(url, json=payload, headers=headers, params=params, timeout=10)
        response.raise_for_status()
        
        result = response.json()

• Confidence: 82% confidence
• Finding: This markdown/post send path also transmits user-provided content to Feishu, so it is an external data-transfer primitive. The risk is not from the HTTP call itself but from the absence of guardrails preventing sensitive or unapproved content from being sent to external recipients in an agent workflow.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The main descriptive sentence for the skill is presented in Chinese, which can impose a language requirement on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The configuration loader reads FEISHU_APP_ID and FEISHU_APP_SECRET from the environment, which is access to sensitive authentication material. While the code does not print the secret, there is no explicit disclosure to users that the skill depends on and consumes stored credentials for external messaging.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: This code file contains user-facing natural language such as the module docstring, argument descriptions, and examples primarily in Chinese. The skill does not indicate that Chinese is optional, user-selectable, or required for a region-specific purpose, which can violate a language/locale policy requiring neutrality or user choice.

Static analysis

No suspicious patterns detected.