ClawHub
Back to skill

Security audit

Feishu Calendar

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Feishu calendar helper, but it can modify or delete live calendar data with broad fallbacks and limited user safeguards.

Review before installing. Use a least-privilege Feishu app, isolate the credentials from other workspace secrets, and test only against a dedicated calendar. Do not run setup, cleanup, or sync routines until you have confirmed the target calendar, event visibility, and deletion behavior are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill explicitly loads Feishu app credentials from a shared ../../.env file and immediately uses them to create an authenticated API client, even though the file's purpose is calendar cleanup rather than secret management. In an agent-skill context, reaching outside the skill directory for shared credentials broadens access scope and can enable unauthorized API actions if the skill is invoked unexpectedly or modified.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script enumerates calendars, falls back to the primary calendar, and deletes matching events automatically based only on loose name filters like 'Test' or 'Invite'. In an agent skill context, this is dangerous because it grants destructive access to user calendar data without clear scoping, confirmation, or safeguards, creating a real risk of unintended data loss.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases "Mark this task" and especially "Remind me to..." are broad, natural-language patterns that can easily occur in ordinary conversation and may cause the skill to create calendar events without sufficiently explicit user intent. In a skill that performs state-changing actions against Feishu calendars, ambiguous activation increases the risk of unintended event creation, attendee assignment, and calendar modifications.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill performs authenticated operations using Feishu credentials and can create calendars, add members, and sync or modify calendar state, yet the description does not warn users that these actions may affect real organizational data. Without a clear user-facing warning, users may unknowingly authorize sensitive changes or expose calendar metadata through routine use of the skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script deletes calendar events immediately once they match simple text conditions, with no user confirmation, no dry-run mode, and no rollback capability. In a setup routine, automatic destructive behavior is especially risky because users may execute it expecting initialization, not cleanup of potentially legitimate events.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script silently creates a recurring daily public calendar event, potentially on the primary calendar, without an upfront warning or confirmation. This can alter a user's environment persistently and broadly expose the event because the permissions are set to public.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code explicitly creates all calendar events with `permissions: 'public'`, which can expose routine schedules, operational habits, and descriptive metadata to unintended viewers. Even though the events do not contain secrets directly, recurring maintenance and briefing schedules can reveal behavioral patterns and internal operations that may aid profiling or targeted abuse.

Credential Access

High
Category
Privilege Escalation
Content
const Lark = require('@larksuiteoapi/node-sdk');
require('dotenv').config({ path: require('path').resolve(__dirname, '../../.env') });

const APP_ID = process.env.FEISHU_APP_ID;
const APP_SECRET = process.env.FEISHU_APP_SECRET;
Confidence
96% confidence
Finding
Loading credentials from ../../.env constitutes credential access from a shared location and gives this script authenticated access to Feishu APIs. In this context the danger is elevated because the same script also enumerates calendars and deletes events, so stolen or misused credentials could enable destructive actions against calendar data beyond the narrow cleanup task.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"test": "node list_test.js"
  },
  "dependencies": {
    "@larksuiteoapi/node-sdk": "^1.0.0",
    "dotenv": "^16.0.0"
  }
}
Confidence
84% confidence
Finding
The dependency uses a caret version range, which permits installation of newer minor/patch releases that were not explicitly tested with this skill. If an upstream package release is compromised or introduces a breaking security regression, consumers may automatically receive the unsafe version during install.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "@larksuiteoapi/node-sdk": "^1.0.0",
    "dotenv": "^16.0.0"
  }
}
Confidence
84% confidence
Finding
The dotenv dependency is specified with a caret range, allowing automatic adoption of future compatible releases. This increases supply-chain risk because a malicious or vulnerable upstream release could be pulled in without deliberate review.

Static analysis

No suspicious patterns detected.