Auto Push System Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed Feishu auto-push tool, but it can automatically send local file contents from log-referenced paths to a default chat without strong user control.

Install only if you intentionally want unattended local monitoring that can send file contents to Feishu. Before enabling it, replace and verify the target chat ID, restrict monitored logs and content paths to a dedicated directory, review Feishu permissions, add a manual approval or redaction step for sensitive content, and decide whether automatic renaming of sent files is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and documents extensive shell-script execution, cron setup, log monitoring, and automation, but no explicit permissions are declared. This creates a trust and review gap: users may install a skill with broad execution capability without clear consent or sandbox expectations, increasing the risk of unintended command execution or privileged automation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented behavior extends beyond the stated purpose by including packaging/publishing workflows, system diagnostics, and fixed-target messaging behavior. Such mismatch weakens informed consent and can conceal higher-risk actions, especially when the skill is marketed as a simple content-push workflow but also touches system state, release artifacts, and outbound messaging destinations.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README promotes automatic Feishu notifications and data export while omitting clear warnings that monitored content may be transmitted to third-party services and persisted externally. In a workflow handling AI-generated summaries and briefs, this can lead to accidental disclosure of sensitive or regulated information if users enable automation without understanding the privacy impact.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises automated monitoring of conversation briefs and log files, both of which commonly contain secrets, personal data, or internal business context, but provides no explicit sensitive-data handling guidance. This increases the chance that users will deploy broad log monitoring and automatic forwarding without filtering, causing unintended data exposure.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes automatic monitoring, document creation, and Feishu pushing without a prominent warning that user or system-generated content will be transmitted automatically. In a workflow handling summaries and conversation briefs, lack of explicit disclosure can lead to accidental exfiltration of sensitive or regulated data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup instructions enable cron-based continuous monitoring and automated processing without emphasizing that actions will occur without per-run confirmation. This is risky because users may unintentionally monitor broad file paths or logs and continuously push newly detected content to Feishu.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The installer non-interactively creates executable helper scripts and configuration files in place, which can alter system behavior without an explicit review step. In an agent-skill context, silently writing runnable scripts increases the risk of unexpected automation, especially when those scripts later read logs and transmit content externally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer uses sudo to modify /var/log without an explicit warning or consent step. Any privilege-requiring filesystem change in an install script is sensitive because it trains users to elevate privileges for code that also generates other automation assets.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The generated push-content script reads up to 1000 lines from an arbitrary content file and sends that content to a hard-coded Feishu chat target. In this skill context, that is the most significant risk because files discovered from logs can contain sensitive summaries, conversations, or other data, and the exfiltration occurs automatically without an at-send consent gate.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports logging, preserving, and pushing conversation briefs and other generated content, creating a realistic risk of collecting and forwarding sensitive natural-language data. Because the design emphasizes zero-touch automation and audit retention, accidental disclosure can persist and spread beyond the original context.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The workflow semantics describe automatic document creation, notification, and recordkeeping for conversation briefs, which can disclose sensitive user content to external recipients and leave durable records. The risk is amplified by automation because a single misconfiguration can repeatedly expose private material without human review.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: Broadly described analytics export functionality can expose operational data and user-derived content if exported datasets are not tightly scoped. Without documented limits, redaction, or access controls, analytics exports may become an additional exfiltration channel.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.