Feishu Cli Export

• Outcome: Review
• Latest audit: May 29, 2026 at 9:26 PM UTC
• Version:
  1.0.0

Overview

This mostly looks like a Feishu document export helper, but it also includes an under-disclosed workflow that can upload local files into Feishu.

Review before installing. Use this skill only with a trusted `feishu-cli`, least-privilege Feishu credentials, and documents you are allowed to export. Do not let an agent run the import-file workflow unless you explicitly intend to upload that local file to Feishu; ideally keep import behavior in a separate skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is declared as export-only, but the documented "doc import-file" workflow adds a separate capability to upload local files into Feishu. That scope expansion can cause an agent to perform unintended data transfer from the local machine to a remote SaaS, which is materially riskier than a read/export operation and may violate user intent or data handling expectations.

VirusTotal

64/64 vendors flagged this skill as clean.