feishu-skills

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

This Feishu skill pack is mostly disclosed and not clearly malicious, but it grants broad Feishu, local file, OAuth, and no-confirmation execution authority that users should review carefully before installing.

Install only if you trust this publisher and are comfortable giving an agent broad Feishu access plus local command execution. Avoid disabling exec confirmations globally, review requested Feishu scopes before approving OAuth, treat local file upload/download/delete and sheet/bitable write operations as sensitive, and be aware that document extraction may install npm packages at runtime.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (88)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes installer behavior that requires network access and environment inspection, yet it declares no permissions or trust boundary information. That makes the skill harder to evaluate safely and can mislead users into approving execution of a script that downloads, installs, and modifies local agent directories without explicit capability disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as a simple installer, but the referenced package enables a much broader set of high-impact actions including OAuth token handling, bot/app registration, message operations, document and drive access, and local package auto-installation. This description-behavior mismatch is dangerous because users may consent to installation without understanding that they are introducing a large privileged integration suite with credential handling and data-access capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The helper silently adds a broad default set of docs/drive/wiki permissions on first-time authorization even when the caller did not explicitly request them. This violates least-privilege and can cause users to grant access to files and knowledge assets unrelated to the immediate task, increasing blast radius if the token is later misused or compromised.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The code comments state the authorization link should not be shown directly, but the fallback path can return the raw verification URL for direct display when IM delivery fails. This inconsistency weakens the intended trust boundary and may expose sensitive auth flow details to channels with weaker presentation guarantees, making phishing or user-confusion attacks easier.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The instruction to execute commands directly with exec and not check files or environment explicitly disables basic safety validation before running local scripts. In an installer/skill context where execution depends on local runtime context and relative paths, this increases the chance of running missing, swapped, or attacker-controlled scripts and can turn ordinary operational failures into unsafe command execution paths.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The calendar skill performs chat member enumeration by name using an app-level tenant token, which expands its effective capability from calendar operations into directory lookup across a chat. That is sensitive because it enables identification of users and collection of member metadata not obviously required for core calendar CRUD, increasing privacy and scope-creep risk if the skill is triggered unexpectedly or reused in broader contexts.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: After creating an event, the skill may send a Feishu card directly to the user with a meeting join link, which is an outbound messaging side effect not described in the skill's stated behavior. Hidden side effects are dangerous because users and operators may not expect the skill to message users directly, and meeting URLs are sensitive artifacts that should only be delivered through clearly disclosed channels.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code exchanges app_id and app_secret for a tenant access token to perform chat member lookup, introducing broader app-level authority into a user-calendar workflow. Mixing user-scoped calendar actions with tenant-scoped tokens is risky because compromise or misuse of this path can expand access beyond the user's own resources and violates least-privilege design.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The calendar skill contains a chat-member enumeration and name-to-open_id resolution feature using a tenant app token, which expands the data-access scope beyond straightforward calendar CRUD. In this context, it enables directory lookup of group members and their availability, increasing privacy risk and making the skill capable of correlating identity and schedule information without a tightly scoped calendar-only boundary.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The instruction to execute directly with `exec` and explicitly avoid checking files or environment removes basic safety validation before running local code. In an agent setting, this increases the risk of executing tampered scripts, wrong paths, or unexpected binaries and makes prompt-injection-style operational abuse easier.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to automatically start and retry OAuth authorization flows without asking the user, which can trigger consent-sensitive actions the user did not explicitly approve in context. Automatic retries on timeout further increase the chance of repeated unsolicited auth prompts or workflow abuse.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: This file implements Feishu chat search, chat detail retrieval, and member listing using user OAuth tokens, which materially expands the skill pack from an installer into a data-access capability. In the context of an installer skill, this is dangerous because it enables access to potentially sensitive organizational metadata and membership information that users may not expect when invoking an installation workflow.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The instruction to 'directly use exec' and 'do not check files or environment' explicitly suppresses normal safety validation before command execution. In an agent setting, this increases the chance of running the wrong script, executing in an unexpected directory, or invoking a tampered file, and the user’s warning to treat such content as adversarial makes this more suspicious rather than less.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script accepts user-controlled --output-dir and --output values and joins them directly into the final output path without validating that the result stays within an approved workspace. An attacker who can influence these arguments or the remotely supplied file title can cause path traversal or arbitrary file placement, potentially overwriting files outside the intended download directory.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The helper executes `npm install` automatically during document extraction, introducing code execution and supply-chain risk as a side effect of processing a file. In an agent skill context, this is especially dangerous because a routine file-handling operation can trigger network access and installation of arbitrary package code without explicit user approval.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: The documentation normalizes automatic dependency installation on first run, obscuring that extraction performs package installation as an operational side effect. This increases the likelihood that users or operators will run the tool in sensitive environments without realizing it may execute installer logic and pull remote code.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The helper dynamically installs npm packages at runtime by invoking `npm install` through `execSync`, which introduces a software supply chain and command execution risk inside a file-processing path. If package resolution is influenced by registry compromise, dependency confusion, tampered lockless installs, or a hostile environment, processing an ordinary document can trigger installation and execution of unpinned third-party code.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The upload path allows reading arbitrary local files via --file-path and transmitting them to Feishu, which creates a powerful data exfiltration primitive inside a skill pack described as an installer. In this context, bundling local filesystem read plus remote upload is more dangerous because users invoking an installer would not reasonably expect file access and outbound content transfer capabilities.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The delete action can permanently remove remote Feishu Drive content using only a token, type, and a CLI confirmation flag. Although there is a lightweight --confirm-delete check, this is not a strong safety control in an installer-context skill and could enable destructive actions against user cloud data if the skill is triggered or reused outside its stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to initiate Feishu authorization automatically and to avoid asking the user first. That creates an unsafe consent boundary for a messaging-read capability, because the agent may trigger an auth flow and request scopes without an explicit, contemporaneous user confirmation.

Intent-Code Divergence

Low

• Confidence: 87% confidence
• Finding: Telling the agent to 'execute directly with exec' and not check files or environment removes basic safety validation before invoking a privileged integration script. In this context, the command depends on auth state, contextual identifiers, and target chat/message parameters, so skipping validation increases the chance of unintended access attempts or misuse.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The instruction to 'directly use exec, do not check files or environment' removes basic safety validation and encourages blind command execution. In an agent setting, this broadens the operational scope from spreadsheet actions to arbitrary execution behavior and increases the chance of running the wrong script, wrong path, or attacker-influenced commands without verification.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill embeds a secondary authorization workflow that automatically launches another tool and polls for approval, which goes beyond simple spreadsheet operations. That cross-skill chaining is risky because it lets this skill trigger permission acquisition flows automatically, expanding privileges and behavior beyond the user's immediate spreadsheet request.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to execute commands immediately without checking files or the environment. In a security-sensitive agent setting, this removes basic guardrails that could prevent running the wrong script, using an unexpected working directory, or triggering sensitive side effects such as auth flows without validation.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: Telling the agent not to inspect the environment or files before execution is unsafe operational guidance because it discourages runtime validation even though later behavior depends on auth and permission conditions. This increases the chance of mis-execution, confusing failures, or unintended command invocation in an unexpected environment.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: feishu-docx-download/extract.js:29

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: feishu-docx-download/extract.mjs:32

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/auth.js:318

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/auth.mjs:320

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/send-card.js:124

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/send-card.mjs:126

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/token-utils.js:41

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-auth/token-utils.mjs:43

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-docx-download/download-doc.js:42

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: feishu-docx-download/download-doc.mjs:44

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-auth/auth.js:211

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-auth/auth.mjs:213

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-auth/token-utils.js:129

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-auth/token-utils.mjs:131

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-quick-setup/quick-setup.js:218

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: feishu-quick-setup/quick-setup.mjs:220

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: feishu-wiki/SKILL.md:55