feishu-codex-bridge

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The primary function of the skill is to translate incoming chat messages from Feishu or Lark into codex exec commands that are executed directly on the host machine. This provides a remote interface to the local shell.
  • [REMOTE_CODE_EXECUTION]: The installation instructions require downloading and running code from a GitHub repository (github.com/QQQingyu/feishu-codex-bridge.git) and an NPM package (feishu-codex-bridge) that do not belong to trusted organizations or the skill's stated vendor. It also automatically installs additional CLI tools (lark-cli, @openai/codex) at runtime.
  • [PERSISTENCE]: The skill includes functionality to install itself as a macOS launchd background service (feishu-codex-bridge service install launchd), allowing it to remain active and restart automatically on the host system.
  • [INDIRECT_PROMPT_INJECTION]: The bridge processes untrusted input from external chat messages and file attachments, which are then used as parameters for command execution.
  • Ingestion points: Feishu/Lark chat messages and file attachments (e.g., images and documents).
  • Boundary markers: None described; the bridge maps chat topics directly to sessions.
  • Capability inventory: Execution of shell commands via codex exec, file system writes to ~/.feishu-codex-bridge/, network communication with Feishu/Lark APIs, and management of local processes (/ps, /exit).
  • Sanitization: The documentation does not specify any sanitization, validation, or escaping of the chat-provided content before execution.
  • [DATA_EXFILTRATION]: The skill downloads chat attachments to the local disk and has the capability to read local files (through the codex integration and workspace management). Because the bridge maintains a network connection to external chat platforms, it could be used to exfiltrate local data or configuration secrets.
  • [DYNAMIC_EXECUTION]: The bridge dynamically generates and executes commands at runtime based on the natural language instructions received through the chat interface.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 16, 2026, 03:57 AM