feishu-group-manager
Security checks across malware telemetry and agentic risk
Overview
The skill's code shows the expected Feishu API calls, but required authentication and a shared module (feishu-common) are missing and no environment/credential requirements are declared — the bundle is incomplete and could hide where credentials come from.
This package contains legitimate-looking code to GET/PUT Feishu chat settings, but it's incomplete and opaque: it requires a helper module (feishu-common) that isn't included and likely needs Feishu credentials (not declared). Before installing or running it: 1) ask the publisher for the missing feishu-common source and any README describing auth flows; 2) verify where fetchWithAuth gets tokens and ensure it doesn't exfiltrate secrets or post data to unexpected endpoints; 3) require explicit documentation of required env vars (app id/secret or access token) and the minimum API scopes; 4) avoid dropping your real credentials into an unverified package — test in an isolated environment or with a least-privilege Feishu app; 5) if you cannot obtain the missing files or a trustworthy source/homepage, treat the package as incomplete/untrusted and do not run it against production credentials.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings