中文 EN

扫描报告

扫描新文件

✓ 低风险 — 风险评分 10/100
上次扫描：1 天前 重新扫描
10 /100
feishu-assistant
飞书助手，用于发送图片到飞书平台
Legitimate Feishu image sending tool with minor documentation gaps but no malicious behavior detected.
技能名称feishu-assistant
分析耗时43.6s
引擎pi
✓
可以安装
Add allowed-tools declaration to SKILL.md: filesystem:READ, network:READ. No blocking security issues.

安全发现 2 项

严重性 安全发现 位置
低危
Missing allowed-tools declaration 文档欺骗
SKILL.md does not declare allowed-tools permissions. The script infers filesystem:READ (for reading images and config) and network:READ (for Feishu API calls), which are necessary for the skill's stated purpose.
--- name: feishu-assistant ...
→ Add allowed-tools section to SKILL.md header declaring filesystem:READ and network:READ
 SKILL.md:1
提示
No dependency pinning 供应链
The script uses the requests library but no requirements.txt exists. Version is not pinned.
import requests
→ Consider adding requirements.txt with requests pinned to a specific version
 scripts/send_image.py:6
资源类型声明权限推断权限状态证据
文件系统 NONE READ ✓ 一致 scripts/send_image.py:39 - reads image paths; scripts/send_image.py:38 - reads ~…
网络访问 NONE READ ✓ 一致 scripts/send_image.py:50-53,64-76,81-91,99-108 - API calls to open.feishu.cn
命令执行 NONE NONE — No shell execution found
5 项发现
🔗
中危 外部 URL 外部 URL
https://open.feishu.cn/
SKILL.md:21
🔗
中危 外部 URL 外部 URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal
scripts/send_image.py:50
🔗
中危 外部 URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/images
scripts/send_image.py:64
🔗
中危 外部 URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages
scripts/send_image.py:81
🔗
中危 外部 URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages/
scripts/send_image.py:99

目录结构

2 文件 · 7.9 KB · 247 行
Python 1f · 178L Markdown 1f · 69L
├─ ▾ 📁 scripts
│ └─ 🐍 send_image.py Python 178L · 5.9 KB
└─ 📝 SKILL.md Markdown 69L · 2.0 KB

依赖分析 1 项

包名版本来源已知漏洞备注
requests unknown pip 否 No requirements.txt; version not pinned

安全亮点

✓ Clean, readable Python code with no obfuscation
✓ All network calls go to official Feishu API (open.feishu.cn)
✓ Credentials are used locally for authentication only - no exfiltration
✓ Config file path (~/.openclaw/openclaw.json) is standard and expected
✓ File operations are minimal and necessary for stated purpose
✓ No base64, eval, or other obfuscation patterns
✓ No sensitive path access (no ~/.ssh, ~/.aws, .env reading)