Feishu Power Skill

• Analyzed: May 12, 2026, 4:27 AM
• Findings: 1
• Version: 1.0.0
• Hash: dadacdc7601e096c875ee7a7c73dfaa1f75ad7339f193456529d61334ade891d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant Arbitrary Code Execution (ACE) vulnerability in `scripts/report_generator.py`. The `run_custom_report` function directly executes external scripts via `subprocess.run` using parameters (`script` and `args`) that could be controlled by an attacker through prompt injection against the AI agent. This allows for arbitrary command execution on the host system. Additionally, `scripts/bitable_engine.py` and `scripts/doc_workflow.py` allow reading from and writing to arbitrary local file paths (`--data`, `--output`, `--local`), which could lead to sensitive file exfiltration or overwriting if attacker-controlled paths are provided. While these are severe vulnerabilities, there is no clear evidence of intentional malicious behavior (e.g., hardcoded exfiltration endpoints, backdoors, or explicit prompt injection instructions for the agent to self-exploit) within the provided code or documentation.