feishu-bridge

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The README tells users to embed the Feishu app secret and app id directly into shell commands (echoing the secret into a file and setting FEISHU_APP_ID inline), which encourages exposing secret values verbatim in shell history/outputs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Feishu Bridge workflow, Feishu chat message text received via the Feishu bot event im.message.receive_v1 (delivered as a WebSocket long-connection) is bridged to bridge.mjs and then forwarded into the Clawdbot Gateway/AI agent, so outsider-authored message content is ingested at runtime.