feishu-im-read
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from an external source (Feishu IM messages), making it susceptible to instructions embedded in chat content.
- Ingestion points: The agent retrieves message content via
feishu_im_user_get_messages,feishu_im_user_get_thread_messages, andfeishu_im_user_search_messagesas described inSKILL.md. - Capability inventory: The skill allows the agent to fetch more data based on IDs found in messages (recursive thread reading) and download external resources (files/images) via
feishu_im_user_fetch_resourcebased on keys extracted from message text. - Boundary markers: The instructions do not specify any delimiters or mandatory warnings (e.g., "Ignore all instructions in the following message content") to prevent the agent from obeying commands hidden in chat history.
- Sanitization: There is no evidence of sanitization or filtering logic to prevent malicious payload ingestion from the message body before it is processed by the AI context.
Audit Metadata