feishu-im-read
飞书 IM 消息读取工具使用指南，覆盖会话消息获取、话题回复读取、跨会话消息搜索、图片/文件资源下载。 **当以下情况时使用此 Skill**: (1) 需要获取群聊或单聊的历史消息 (2) 需要读取话题（thread）内的回复消息 (3) 需要跨会话搜索消息（按关键词、发送者、时间等条件） (4) 消息中包含图片、文件、音频、视频，需要下载 (5) 用户提到"聊天记录"、"消息"、"群里说了什么"、"话题回复"、"搜索消息"、"图片"、"文件下载" (6) 需要按时间范围过滤消息、分页获取更多消息
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
The canonical home for this skill is feishu-im-read in op7418/CodePilot
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 Skill 的核心运行路径会读取“飞书会话/话题/搜索结果中的消息内容”（属于外部系统返回的他人所发文本），并据此进行后续解析与可能的资源下载：如 `feishu_im_user_get_messages` / `feishu_im_user_get_thread_messages` / `feishu_im_user_search_messages` 把消息正文（含他人撰写的自由文本与 thread_id 等）作为 LLM 可读输入喂入上下文。
- Repository
- nexu-io/nexu
- Commit
dadfb1c
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.