The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface within its interactive notification workflow (Step 3). It polls an external bridge server for user replies and returns this untrusted content to the calling agent. If the bridge server is compromised or the input is not properly sanitized by the downstream skill, it could be used to inject malicious instructions into the agent's context.
Ingestion points: Configuration from ~/.claude/feishu.json and user-provided replies from the $BRIDGE_URL/poll endpoint.
Boundary markers: None observed; the skill instructions do not specify delimiters or warnings for the retrieved content.
Capability inventory: Use of curl for network requests and cat for file system access.
Sanitization: No evidence of validation or sanitization for the data received from the external bridge.
[EXTERNAL_DOWNLOADS]: References an external GitHub repository (github.com/joewongjc/feishu-claude-code) as a necessary external component for interactive bidirectional communication.
[DATA_EXFILTRATION]: Sends message data and events to Feishu's official API (open.feishu.cn) and a user-configured bridge server. While these are the intended destinations for the skill's purpose, they involve transferring data to external network endpoints.
[COMMAND_EXECUTION]: Employs shell commands via curl to perform network operations and cat to retrieve local configuration settings from the user's home directory.

aris-feishu-notify