Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Feishu meeting-room booking helper that uses expected calendar permissions and narrowly described local state files.
Install only if you are comfortable granting the Feishu calendar scopes needed to read recent events, create events, update attendees, and check room availability. Review the saved room preference file if room order or default city matters.
The skill requires local file access to read and write state and temporary JSON files, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: the runtime may grant broader file capabilities than intended, making accidental or unauthorized file access harder to constrain and audit.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Manual refresh only. Never auto-refresh cached rooms.
- The cached room list is single-city v1. Store one base location (default city) and one ordered room list. The internal state field name remains `default_city`.
- On first use, if `state/feishu-meeting-room-book.json` does not exist and the user asked to create/book a room or book an existing event, do not ask the user to initialize separately. Tell the user you are starting first-time initialization, run init immediately, and continue the original request after the default room order has been saved.
- During init/refresh, the extracted candidate order is the default priority order. Do not reshuffle it unless the user explicitly changes it.
- When creating a new event, use defaults instead of asking follow-up questions for common omissions:
- missing title: use summary `会议`
No suspicious patterns detected.