feishu-notify
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
feishu-notify.sh) to manage configuration and send data. It correctly uses argument passing ("$url" "$title" "$body") to prevent shell injection vulnerabilities when executing Python logic. - [EXTERNAL_DOWNLOADS]: The README provides an installation command using
npx skills add unnc-aim/aim-common-agentic-skills. This is the standard mechanism for installing skills from a vendor repository. - [CREDENTIALS_SAFE]: The skill instructs users to store their webhook URL in
~/.claude-feishu-notify.json. The script explicitly sets file permissions tochmod 600(read/write by owner only) when creating the file, which is a security best practice for managing sensitive local configuration. - [DATA_EXFILTRATION]: While the skill sends data to a remote URL (Feishu), this is the primary and documented purpose of the skill. The network operation is limited to the user-configured webhook URL.
Audit Metadata