Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Douyin-to-Feishu analysis workflow with expected external writes, and I found no hidden code, persistence, or deceptive behavior.
Before installing, verify the configured Feishu base and table point to the intended workspace, keep API keys in environment variables as instructed, and expect the skill to write records/doc links and potentially download video files when used.
The markdown describes remote write operations to Feishu Bitable and generation/linking of cloud documents, which can affect user data and external system state. While the file notes permissions and rate limits, it does not clearly warn users that running the skill will create or modify records/documents in Feishu.
The natural-language content of the skill is presented only in Chinese, which may force a specific language on users without opt-in. The policy allows locale constraints when documented and justified, but this file does not explain any language limitation or provide alternatives.
No suspicious patterns detected.
