The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands using curl where user-provided input from $ARGUMENTS (and data from other skills) is interpolated into the -d JSON payload. There is no evidence of shell escaping or sanitization, which allows a malicious message to break out of the JSON string and execute arbitrary commands on the local system (e.g., using backticks or command substitution).
[REMOTE_CODE_EXECUTION]: The documentation explicitly directs users to download and run a bridge application from a third-party GitHub repository (github.com/joewongjc/feishu-claude-code) for interactive mode. This source is not a verified or well-known vendor, posing a risk of executing unvetted or malicious code on the user's machine.
[DATA_EXPOSURE]: The skill is designed to read ~/.claude/feishu.json, a configuration file containing sensitive data such as Feishu webhook URLs. While this is necessary for the skill's function, it establishes a pattern of accessing sensitive configuration files in the user's home directory.
[INDIRECT_PROMPT_INJECTION]: In interactive mode, the skill polls a remote BRIDGE_URL and returns the response directly to other calling skills (like /auto-review-loop or /run-experiment). If these calling skills process the 'reply' content as instructions, an attacker who controls the bridge or the Feishu account could influence the agent's behavior.
Ingestion points: Network response from curl -s "$BRIDGE_URL/poll..." in SKILL.md (Step 3).
Boundary markers: None; the raw reply is returned to the calling skill.
Capability inventory: Calling skills listed in the 'Event Catalog' (e.g., /run-experiment, /research-pipeline) typically possess broad capabilities including file system access and subprocess execution.
Sanitization: None; the skill provides no mechanism to validate or escape the content received from the remote bridge.

feishu-notify