feishu-bitasks-manager
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
assets/config.jsoncontains hardcoded, valid-looking Feishu API credentials includingapp_idandapp_secret. These secrets grant programmatic access to the configured Feishu application and its associated data. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile contains a shell command that executespip install requestsif the library is not detected. Installing dependencies at runtime from external registries without version pinning or integrity checks introduces a supply chain risk. - [COMMAND_EXECUTION]: The skill uses
allowed-toolsto execute arbitrary Python commands and scripts via Bash, which is necessary for its functionality but increases the impact of any potential command injection if user input were improperly handled in the script logic.
Recommendations
- AI detected serious security threats
Audit Metadata