feishu-codex-bridge

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub repo (https://github.com/QQQingyu/feishu-codex-bridge.git) and its npm-distributed package are suspicious because the author/account is unvetted and the project instructs global npm install, auto-installs/runs local binaries (codex, lark-cli), spawns commands and services and downloads attachments — all common vectors for malware/exfiltration; ara.so (https://ara.so) appears to be the project site (lower risk) but does not mitigate the risk of installing an untrusted package from the GitHub/npm source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This bridge intentionally exposes remote command execution (chat → local codex exec), persistent service installation, attachment/download handling, and OAuth access to user resources — features that can be abused as a remote backdoor and for data exfiltration if access controls, OAuth, or installations are misconfigured or compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow ingests outsider-authored Feishu/Lark chat message text (e.g., im.message.receive_v1 event payloads) into the bridge, which then converts that free-form content into context/commands for the local codex exec/LLM streaming replies—this is classic indirect prompt-injection exposure from third-party user messages.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill turns chat messages into local codex exec commands (remote code execution), can install/manage a macOS launchd service, install global packages, write config/secrets and manage processes/workspaces — all actions that modify the host system state and can require elevated privileges.