Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Feishu workflow assistant that requests broad but purpose-aligned workplace integration and includes clear confirmation boundaries for writes.
Install only with a Feishu app whose scopes match what you actually need. Start in counselor mode for read-only summaries and drafts, and use executive mode only when you are comfortable allowing confirmed actions such as sending messages, editing tables, or coordinating schedules.
This markdown file uses Chinese throughout examples and headings, which implies a fixed language experience for the skill. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
The trigger phrases include very generic workplace requests such as meeting notes, weekly report generation, and message organization. In a broadly integrated enterprise skill, overly broad triggers can cause accidental invocation during normal conversation, leading the agent to access or act on Feishu data or workflows when the user did not clearly intend to use this skill.
The audience is explicitly limited to "中国企业管理者" and related Chinese enterprise users, while the description and triggers are primarily Chinese-language, but the manifest does not state that this locale restriction is optional or justified by a region-specific compliance requirement. This can constitute a language/locale policy issue because the skill appears to force a specific locale context without offering user choice.
No suspicious patterns detected.
