KD（快导）

• Outcome: Review
• Latest audit: May 28, 2026 · 8:45 AM UTC
• Version: 1.0.4

Overview

This skill mostly matches its short-video script workflow, but its optional Feishu integration asks for very broad workspace permissions and its report-upload instructions are inconsistent enough to require review before installation.

Review and reduce the Feishu permissions before use, especially tenant-wide messaging, app management, chat, and broad file/document scopes. Treat Feishu upload as opt-in only: inspect reports before publishing, redact internal paths/configuration/generated content as needed, and keep the workflow local if you do not need wiki reporting. Also confirm Excel and rules paths point only to files you control.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The declared Feishu scopes grant capabilities far beyond the stated purpose of generating and managing short-video scripts, including broad messaging, app self-management, bot menu writes, chat/member access, and file/document/wiki read-write across tenant resources. If the skill or its tokens are abused, these excessive permissions could enable unauthorized data access, content tampering, message abuse, or broader workspace compromise, violating least-privilege expectations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The constructor accepts an arbitrary config_path and later writes JSON to that path without any restriction that it remain inside the skill's data directory. If untrusted input can influence config_path, the skill could overwrite unrelated files accessible to the process, creating a path traversal / arbitrary file write condition within the process's filesystem permissions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file is a Feishu permission-enablement helper, which is inconsistent with the declared skill purpose of short-video script generation and copy library management. This kind of scope mismatch is dangerous because it can normalize or facilitate requesting broader platform permissions unrelated to user expectations, increasing the risk of overprivileged deployment and unauthorized data access.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The skill includes subprocess-based clipboard integration, which is not justified by the stated content-generation use case and adds a capability to move generated permission JSON into the user's system clipboard. In the context of an unrelated permission helper, this increases concern because it streamlines permission escalation workflows and expands host interaction beyond what users would reasonably expect from a script-generation skill.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The workflow conditionally invokes an external web search tool (`openclaw.tools.web_search`) to fetch TikTok trending content, which extends behavior beyond the declared skill scope of script generation and copy-library management. This matters because it sends data to an external service and introduces network-side effects that users may not reasonably expect from the manifest, increasing privacy, compliance, and supply-chain risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Overly broad shortcut phrases can cause accidental invocation of configuration-changing or workflow-executing actions when a user makes a general request. In an agent environment, ambiguous triggers increase the risk of unintended file modifications, report generation, or external actions without sufficiently informed user intent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes automatic external web search, including auto-collect behavior when keywords are absent, without a clear user-facing outbound-network warning at the point of use. This creates a privacy and consent risk because user context or inferred topics may be sent to external services unexpectedly, and failures can alter workflow behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The report explicitly instructs the agent to persist detailed execution records, task outputs, write locations, problem logs, and local fallback files without any requirement to minimize, classify, or redact sensitive data first. In this skill context, the report aggregates operational history and generated content, so sending it to Feishu or storing it locally can expose internal workflow details, document paths, and potentially sensitive business content beyond what is necessary.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template includes raw snapshots like platform configuration, rules summaries, and generated scripts, which may contain sensitive configuration values, proprietary prompts, or confidential content. Embedding these verbatim in a report intended for upload increases the risk of inadvertent disclosure because there is no warning or sanitization step before publication.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Feishu command publishes the full report to a wiki as the user, causing remote transmission and storage under the user's identity without any visibility warning, scope check, or confirmation prompt. In this context, the report may contain detailed outputs and snapshots, so automatic publication can leak sensitive data to a broader audience than intended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes an automated rollback path that deletes rows from the Excel file when validation fails, but the skill metadata does not clearly warn users up front that destructive actions may occur. In a document-management context, this can cause unintended data loss or corruption if row ranges are miscomputed, if concurrent edits occurred, or if the rollback is triggered on a false positive during validation.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The README states that cached/generated files are automatically retained and cleaned up, but it does not clearly foreground that the skill writes to and deletes data from the local filesystem during normal operation. In an agent skill context, insufficient disclosure about local file creation and deletion can lead users to run the skill without understanding persistence and cleanup side effects, increasing the risk of unintended data loss or surprising system modifications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: At the point of execution, the code issues a web search query to an external tool without presenting a contemporaneous user-facing warning or consent check. Even though the current query string is hardcoded, invoking third-party search still creates undisclosed outbound data flow and may violate user expectations or environment policies for an offline/local content-generation skill.

Static analysis

No suspicious patterns detected.