Feishu Agent Relay - Multi-Bot Collaboration

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This is a coherent Feishu relay skill, but it needs review because weak identity binding could misroute private bot messages.

Install only for personal use or tightly controlled internal testing unless you add verified identity binding, restrict Feishu bot access, protect the mapping file, define retention/deletion rules, and obtain user consent for cross-bot identifier sharing and proactive messages.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: This is a real security issue. The guide claims there is no identity spoofing risk, but the documented design auto-binds the single hardcoded user ID "me" to the first sender and even updates that binding if the sender open_id changes, effectively letting message origin determine account ownership without authentication. In a supposedly single-user deployment that is ever exposed to another sender, an unauthorized user could claim or overwrite the mapping and receive relayed messages intended for the legitimate user.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide explicitly instructs operators to manually collect and persist user IDs/open_id mappings, which are personal identifiers, but it does not warn about privacy obligations at the point of collection. In this skill’s context, the mapping table links users to multiple bots and enables proactive messaging, so weak handling could lead to unnecessary retention, unauthorized access, or cross-user misrouting of messages.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document explicitly defines features to track firstSeen/lastActive and to list all users, including universal user IDs, names, and bot-specific identifiers, but provides no privacy, retention, access-control, or minimization guidance. In an identity-resolution mapping system, this omission can lead implementers to expose or over-collect sensitive user metadata, increasing privacy and insider-abuse risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example explicitly collects and persists user identifiers such as User ID and Feishu Open ID, but does not include any notice, consent step, retention policy, or minimization guidance. In an agent relay system, these identifiers are linkable personal data, so normalizing storage without privacy safeguards can lead implementers to build non-compliant data handling and increase the blast radius of accidental disclosure.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation promotes automatic first-contact registration and mapping writes without clearly warning that user identifiers and per-bot open_id mappings will be stored immediately. This can lead operators to deploy behavior that collects and persists identity data without informed consent, review, or retention controls. While primarily a privacy and governance issue, it can also expand attack surface by creating sensitive mapping state automatically.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Limitations

- Manual User ID entry in multi-user mode (no verification)
- Requires multiple Feishu Bot applications
- Internal/enterprise use only

• Confidence: 92% confidence
• Finding: no verification

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.