飞书每日早报

• Outcome: Review
• Latest audit: May 28, 2026 · 11:31 AM UTC
• Version: 1.0.3

Overview

This skill can send a morning news message to a fixed Feishu account without clear user control, so it should be reviewed before installation.

Install only after reviewing or disabling the bundled push scripts. If Feishu delivery is desired, replace the hard-coded recipient with your own validated configuration, require preview or confirmation before sending, and grant Feishu messaging permissions only if the documented behavior matches what you want.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documentation describes outbound network access to a news API and a weather skill, yet no explicit permissions are declared. Undeclared capabilities create a trust gap: reviewers and users cannot accurately assess what the skill is allowed to do, and hidden shell capability is especially concerning because it exceeds what is needed for simple news formatting. In a content-generation skill, network access may be expected, but shell access is not, which makes this more suspicious.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This finding indicates the skill does more than its stated purpose, including direct Feishu message sending, active push behavior, local logging, and retry logic. That mismatch is dangerous because users may invoke what appears to be a harmless report-generation skill while it actually performs message delivery and persistence side effects, enabling unauthorized outbound communication or data retention. In this context, the skill text explicitly says not to send messages directly, so contradictory hidden behavior is even more risky.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script performs an outbound action by sending a message directly to a hard-coded Feishu user ID, which exceeds the described configuration/assembly behavior and creates an undisclosed data-flow to a specific recipient. In an agent-skill context, hard-coded recipients are risky because fetched content can be delivered automatically without user confirmation, enabling unintended messaging or covert exfiltration if the content or recipient changes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script does not merely prepare or configure a morning-news workflow: it directly sends content to a hard-coded Feishu user ID. This creates an unauthorized outbound communication path and can cause unintended data delivery or spam, especially if the script is triggered automatically or reused in another environment.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrase example is broad enough to match ordinary conversation, which can cause unintended activation of the skill. For a skill that performs network retrieval and may have side effects according to the other findings, accidental invocation increases the chance of unwanted external requests or automated actions. The surrounding context makes this more concerning than a purely local, read-only skill.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code sends externally fetched content to a fixed Feishu open_id without warning, disclosure, or an opportunity for the user to review the payload. In this skill context, that makes the behavior more dangerous because the skill is presented as a morning-news configuration tool, so silent delivery to a specific account is unexpected and could be abused for spam, privacy violations, or covert message routing.

Static analysis

No suspicious patterns detected.