ClawHub
Back to skill

Security audit

feishu-minutes

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended to download Feishu Minutes data, but it under-discloses sensitive credential handling and persistent local storage behavior users should review first.

Install only if you are comfortable giving the skill Feishu app credentials and storing meeting transcripts, metadata, and media locally. Run it from a directory without unrelated secrets in .env files, use a dedicated low-permission Feishu app, choose an explicit private --out directory, and review or clear the shared memory/feishu_token.json cache when done.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly fetches meeting metadata, transcripts, and media and writes them to local storage, but the description does not warn users that these artifacts may contain highly sensitive business or personal information. This omission increases the risk of accidental exposure through unsafe output locations, syncing, backups, or sharing, especially because users may not realize the command persists full meeting contents to disk.

VirusTotal

No VirusTotal findings

View on VirusTotal