ClawHub
Back to skill

Security audit

Feishu Card Design 飞书卡片消息设计规范

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Feishu card design/template helper; it does not itself send messages, read credentials, or install persistent components, but users should review the included example buttons and fallback messaging guidance.

Install this if you need Feishu card schemas, templates, and local validators/builders. Keep Feishu credentials and actual message-sending tools separate, require user confirmation before sending cards, and remove or replace the share/archive buttons and text fallback guidance if those actions are outside your intended permissions.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is explicitly described as a pure specification skill that should not directly send Feishu messages, yet this section provides executable fallback logic for sending a card and then a plain-text message. In an agent-skill context, this can expand the operational scope from documentation into messaging behavior, increasing the chance that downstream agents implement out-of-scope message delivery or text-only fallbacks contrary to policy.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The documented fallback explicitly recommends sending plain text when cards are unsupported, which conflicts with the skill scope that says not to use it for direct IM sending or text-only messages. If copied into agent behavior, this can cause policy violations, unintended user communications, and erosion of guardrails that rely on the skill remaining presentation-only.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The template includes built-in action buttons for '分享到群' and '存档到知识库' even though the skill metadata explicitly states it must not be used for IM group management or knowledge-base/document operations. This creates a policy/permission boundary mismatch: downstream agents or users may rely on the template and unintentionally trigger workflows outside the declared scope, especially if the placeholder example URLs are later replaced with real internal endpoints.

Static analysis

No suspicious patterns detected.