feishu-notify

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly reads the local config with cat (~/.claude/feishu.json) and then uses the webhook URL in curl, which requires the agent to access (and could require echoing) a secret webhook/token value.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repository is a third‑party project of unknown trustworthiness that the skill expects you to run locally as a bridge (potentially requiring downloading and executing code), while the other URLs are an official Feishu webhook and a localhost endpoint and are not suspicious.