feishu-codex-bridge
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The primary function of the skill is to translate incoming chat messages from Feishu or Lark into
codex execcommands that are executed directly on the host machine. This provides a remote interface to the local shell. - [REMOTE_CODE_EXECUTION]: The installation instructions require downloading and running code from a GitHub repository (
github.com/QQQingyu/feishu-codex-bridge.git) and an NPM package (feishu-codex-bridge) that do not belong to trusted organizations or the skill's stated vendor. It also automatically installs additional CLI tools (lark-cli,@openai/codex) at runtime. - [PERSISTENCE]: The skill includes functionality to install itself as a macOS
launchdbackground service (feishu-codex-bridge service install launchd), allowing it to remain active and restart automatically on the host system. - [INDIRECT_PROMPT_INJECTION]: The bridge processes untrusted input from external chat messages and file attachments, which are then used as parameters for command execution.
- Ingestion points: Feishu/Lark chat messages and file attachments (e.g., images and documents).
- Boundary markers: None described; the bridge maps chat topics directly to sessions.
- Capability inventory: Execution of shell commands via
codex exec, file system writes to~/.feishu-codex-bridge/, network communication with Feishu/Lark APIs, and management of local processes (/ps,/exit). - Sanitization: The documentation does not specify any sanitization, validation, or escaping of the chat-provided content before execution.
- [DATA_EXFILTRATION]: The skill downloads chat attachments to the local disk and has the capability to read local files (through the
codexintegration and workspace management). Because the bridge maintains a network connection to external chat platforms, it could be used to exfiltrate local data or configuration secrets. - [DYNAMIC_EXECUTION]: The bridge dynamically generates and executes commands at runtime based on the natural language instructions received through the chat interface.
Recommendations
- AI detected serious security threats
Audit Metadata