Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Feishu file-sending skill whose main risk is that users must carefully review which local files are sent externally.
Install only if you intend agents to send files through Feishu. Before use, verify the recipient/channel, exact file paths, file contents, and whether batch sends or compressed archives include anything sensitive, confidential, personal, or unauthorized for external sharing.
The markdown explicitly promotes sending local files directly and in batches, which can affect user data and privacy by transmitting file contents to an external messaging platform. Under the markdown-file criteria for SQP-2, the description should include a warning or caution about verifying file contents, recipients, or sensitivity before sending.
The skill documentation explicitly instructs use of the exec tool to run shell commands for file discovery. Even though the example command is narrow, adding arbitrary shell execution to a skill whose stated purpose is simply sending Feishu attachments unnecessarily expands the attack surface and can normalize command execution on attacker-influenced paths or patterns.
The compression feature introduces additional shell commands unrelated to the manifest's core purpose of directly sending attachments. This broadens the skill from file sending into arbitrary file transformation and command execution, increasing the risk of unsafe archive creation, path misuse, and abuse of exec in contexts where only attachment sending should be needed.
The document explains how to send a local file directly to Feishu but omits any warning that using the local path will transfer that file’s contents to an external messaging platform. In this context, the missing disclosure is dangerous because the entire skill is an egress mechanism, and users or downstream agents may treat local paths as harmless references rather than outbound data transfer.
The batch-send example combines local file enumeration with automated transmission of multiple files to Feishu without any warning, filtering for sensitivity, or per-file confirmation. That materially increases exfiltration risk because a single invocation could send several internal documents outside the environment quickly and with little review.
The skill’s stated purpose is sending files via Feishu, but it also instructs the agent to run shell commands to enumerate local files. That broadens capability from message delivery to filesystem discovery, which can expose unrelated sensitive filenames and enable selection of unintended files for exfiltration.
The natural-language content appears to require Chinese to understand the skill documentation, and there is no indication that users may choose another language or that the language restriction is intentional and justified. This matches the policy category for language or locale constraints without user opt-in.
The troubleshooting guidance says to use English filenames to avoid garbled display, which is a language/locale constraint stated as a directive rather than an optional workaround. This can conflict with language-choice policy because it does not offer the user a choice or frame the constraint as opt-in.
The troubleshooting section recommends using shell execution to inspect filesystem state, which exceeds the minimal privilege needed for a file-sending skill. Even limited inspection can reveal sensitive path information and normalize unnecessary shell access in a workflow that transmits data externally.
No suspicious patterns detected.
