Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward helper for submitting Feishu/Lark leave requests and does not include hidden code, persistence, or unrelated data access.
Install only if you intend the agent to help file Feishu/Lark leave requests. Review the leave dates, type, duration, and reason carefully before confirming, because the workflow submits employment-related information to your organization’s Feishu approval system.
The description uses broad trigger phrases like wanting to request time off or mentioning taking leave, which can cause the skill to activate on ordinary conversation without a clearly bounded intent. In a skill that drives browser automation and submits HR requests, overbroad activation increases the chance of collecting sensitive personal details or initiating an unintended leave workflow.
The skill instructs the agent to collect leave date, duration, type, and reason, then submit them into Feishu, but it does not explicitly tell the user that these personal and potentially sensitive employment details will be transmitted to a third-party application. This weakens informed consent and can lead to unintentional disclosure of HR-sensitive information through automation.
The instructions present bilingual labels and later direct the agent to look for Chinese UI text such as '工作台' and '审批', which assumes a particular Feishu locale. Because no user opt-in or locale selection is offered, this may conflict with language/locale policy expectations for user choice.
No suspicious patterns detected.
