dot-skill

SUSPICIOUS. The skill’s purpose broadly matches persona/skill generation, but its actual footprint is much wider: it collects private chats and documents, asks for high-value Feishu credentials, may write custom token-using scripts, uses browser-authenticated scraping, and can install derived skills into host environments. Data mainly goes to official vendor endpoints, which argues against confirmed malware, but the privacy scope, credential forwarding, and transitive installation are disproportionate enough to make this a high-risk skill.

This is browser-automation scraping code that reuses an existing authenticated Chrome profile to access Feishu resources and extract potentially sensitive document content and group chat message histories, then outputs them to stdout and/or a file. While there is no clear evidence of classic malware (e.g., reverse shells or exfiltration to unknown domains) in the provided snippet, the combination of persistent session reuse, automated harvesting of private communications/content, and export to disk makes it a significant privacy/security risk. Additionally, the use of page.evaluate with f-string interpolation of user-controlled values is an unsafe injection-like pattern. Runtime confidence is reduced due to apparent syntax/termination issues in the pasted fragment.

No overt malware behavior is evident in this fragment (no obfuscation, command execution, or non-Feishu network exfiltration). However, the code is explicitly a credentialed workplace data harvester: it can enumerate a user’s chats, retrieve message text, optionally retrieve private chat messages, and fetch document/wiki raw contents, then write everything to local disk. It also stores app_secret and user access tokens (and refresh_token) in plaintext JSON under the user’s home directory and prints an access token prefix to stdout—together creating meaningful credential leakage and privacy/data-governance risk. Use should be gated by strict access controls and user consent; secrets storage and console logging should be hardened.

The code is not obviously obfuscated and contains no direct eval/exec or shell execution. However, it is a high-capability collector that harvests confidential enterprise data from DingTalk (documents, bitable records, and chat history via Playwright scraping) and writes it to local files. It also uses a persistent local Chrome profile (cookies/session), which increases impact. There is no explicit exfiltration to a non-DingTalk domain in this snippet, but the confidentiality risk is substantial and it could be misused for data theft/insider threats.

This Python module itself does not contain overt malicious behaviors (no network connections, no eval/exec, no persistence beyond saving its own configuration). However, it creates a significant security risk by executing an external npm package/tool at runtime via `npx -y feishu-mcp` without pinning or integrity verification, while simultaneously supplying high-value Feishu secrets (App Secret and/or User Access Token) to that subprocess via environment variables. It also stores those secrets in plaintext JSON under the user’s home directory and provides an arbitrary file write sink via --output. The true maliciousness would primarily depend on the integrity and behavior of the executed `feishu-mcp` dependency and its supply-chain provenance.