Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

Feishu Post

skill · berabuddies/SemiaApache-2.0 licenceAudited 19 Oct 2026 · source ad9eea27f661

★ 613pushed 47 days ago
✓SAFEGrade B · 89/100 · 19 Oct 2026 · ad9eea2
613repo stars · whole berabuddies/Semia
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit ad9eea27f661 and observed filesystem access and no hard-coded secrets. What it does: Semia, security audit for AI agent skills.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Feishu Post (berabuddies/Semia)”. Retrieved 19 Oct 2026. https://modelsatlas.com/skills/berabuddies/feishu-post

Trust audit

Audit 0.4.1 · source read 19 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium3 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemDeclared1 observation
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS2
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS1
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (3)

LOWFilesystem / pathfs.traversal · utils/feishu-client.js:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
return require("../../feishu-common/index.js");
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@larksuiteoapi/node-sdk, commander, dotenv
Why
3 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWInventory / provenanceskill.no_frontmatter · SKILL.md:1
F-13 Inventory / provenanceCWE-1104Layer L3
Why
SKILL.md lacks name/description frontmatter
Fix
—

Audit 0.4.1 · source sha ad9eea27f661 · 19 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherberabuddies GitHub organizationOwner of the repository this skill is read from
  • Source folderberabuddies/Semia/tests/fixtures/skills/autogame-17/feishu-postThe exact folder we audited
  • LicenceApache-2.0As the repository states it
  • Commit pinned for this verdictad9eea27f661A new audit runs when the source changes
  • Repository statusNot archivedLast push 47 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Semia, security audit for AI agent skills.

# Feishu Post (RichText) Skill

Send Rich Text (Post) messages to Feishu.
This format is distinct from Cards. It supports native rich text elements but is less flexible in layout than cards.
It is better for long-form text mixed with images/links.

## Prerequisites

- Install `feishu-common` first.
- This skill depends on `../feishu-common/index.js` via `utils/feishu-client.js`.

## Features
- **Native Emoji Support**: Automatically converts `[微笑]`, `[得意]` etc. to Feishu native emoji tags.
- **Markdown-like Parsing**: Supports simple newlines and paragraphs.
- **Rich Text**: Uses Feishu's Post content structure.

## Usage

```bash
node skills/feishu-post/send.js --target "ou_..." --text-file "temp/msg.md" --title "Optional Title"
```

## Options
- `-t, --target <id>`: Target ID (user `ou_...` or chat `oc_...`).
- `-x, --text <text>`: Text content (supports `\n` for newlines and `[emoji]` tags).
- `-f, --text-file <path>`: Read content from file.
- `--title <text>`: Title of the post.
- `--reply-to <id>`: Message ID to reply to.

## Emoji List
Supported emojis include: `[微笑]`, `[色]`, `[亲亲]`, `[大哭]`, `[强]`, `[加油]`, and many more.
See `emoji-map.js` for the full mapping.

Excerpt, first 1,186 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit ad9eea2

Download folder ↗
git clone https://github.com/berabuddies/Semia
git -C Semia checkout ad9eea27f661

The author documents no install command, so this uses the repository directly. Our verdict covers commit ad9eea27f661 only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source ad9eea27f661

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B 
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/berabuddies/feishu-post/badge.svg)](https://modelsatlas.com/skills/berabuddies/feishu-post/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

All security skills →
A6 Gemini Video Analyzer✓SAFE

berabuddies/Semia

Native video analysis using Google Gemini API. Upload and analyze video files — describe scenes, extract text/UI, answer questions about content, transcribe speech, identify objects and actions. Use when: (1) User sends…

★ 613Grade B
Council Builder✓SAFE

berabuddies/Semia

Build a personalized team of AI agent personas for OpenClaw. Interviews the user, analyzes their workflow, then creates specialized agents with distinct personalities, adaptive model routing (Fast/Think/Deep/Strategic),…

★ 613Grade B
Email Daily Summary✓SAFE

berabuddies/Semia

Automatically logs into email accounts (Gmail, Outlook, QQ Mail, etc.) and generates daily email summaries. Use when the user wants to get a summary of their emails, check important messages, or create daily email…

★ 613Grade B
Fennecseo Audit✓SAFE

berabuddies/Semia

Uses Fennec SEO Auditor results to audit a URL. Invoke when user wants a quick on‐page/technical SEO health check or to verify favicon/meta/schema and GEO readiness.

★ 613Grade B
Semia✓SAFE

berabuddies/Semia

Audit an agent skill with Semia inside Claude Code. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", or audit a skill/plugin for behavior risk.

★ 613Grade B
Add Gmail!CAUTION

gavrielc/nanoclaw

A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's…

★ 31kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/berabuddies/feishu-post/badge.svg)](https://modelsatlas.com/skills/berabuddies/feishu-post/)

Questions about Feishu Post

What does the Feishu Post skill do?
Semia, security audit for AI agent skills.
Is Feishu Post safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Feishu Post access on my machine?
The audit observed that it reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
What do I need installed to use Feishu Post?
Its own instructions reference feishu-common. Dependencies are not all pinned to exact versions, so what installs today may differ tomorrow.
How current is this page?
The grade is for one exact copy of the source (ad9eea27f661), read on 2026-10-19. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.