Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documented Feishu document-creation helper with persistent workspace writes, but I found no hidden execution, exfiltration, or deceptive behavior.
Install only if you want the agent to create persistent Feishu documents. For sensitive content, specify the target folder or wiki explicitly, and use only trusted public image/file URLs because referenced media may be fetched and uploaded into your Feishu workspace.
The entire skill description and operational guidance are written as mandatory Chinese-language instructions for document creation, with no indication that users may choose another language or locale. Under the policy, a skill that effectively enforces a specific language without user opt-in should be flagged unless the locale restriction is clearly documented and justified.
The skill creates new documents in the user's Feishu workspace and defaults to the personal root folder when no destination is provided, but it does not clearly warn about this side effect near the parameter/behavior description. This can cause unintended writes, workspace clutter, or accidental placement of sensitive content in the wrong location if a user or downstream agent assumes the action is non-persistent or destination-scoped by default.
The skill states that remote image/file URLs are automatically downloaded and uploaded into Feishu, but it does not frame this as a privacy/security warning. That behavior can leak user access patterns, import unreviewed third-party content into the workspace, and cause sensitive external resources to be copied into Feishu without the user fully understanding the transfer.
No suspicious patterns detected.
