feishu-projects
Warn
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
references/attachments.mdfile explicitly directs the agent to execute shell commands usingcurlfor file operations:curl -X POST "<returned_url>" ... --data-binary @<local_file>. This instruction bypasses structured tool interfaces in favor of direct shell interaction. \n- [DATA_EXFILTRATION]: The defined workflow for uploading attachments involves reading the binary content of local files and transmitting it to external URLs. While intended for Feishu project management, this capability represents a potential path for exfiltrating sensitive local data if the destination URL or file path is manipulated. \n- [EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to download content from remote URLs to the local system using command-line tools. \n- [PROMPT_INJECTION]: The skill processes untrusted data from Feishu work items and local configuration files, which could lead to indirect prompt injection. \n - Ingestion points: Feishu API outputs (work item fields, descriptions, and comments) and the
.agents/constant.mdconfiguration file. \n - Boundary markers: The instructions do not specify any delimiters or safety markers to differentiate between instructions and data when processing external content. \n
- Capability inventory: File system access (reading configuration, reading files for upload), network access via
curl, and a suite of tools for project modification. \n - Sanitization: The skill does not include instructions for validating or sanitizing external data before it is rendered or used in query construction.
Audit Metadata