Security audit
Security checks for vulnerabilities and agentic risk
This skill is a focused Feishu troubleshooting guide that uses official Feishu APIs and admin UI steps, with sensitive credentials involved but no hidden code or persistence.
Install only if you are comfortable using it with a Feishu custom app. Keep app_secret and tenant_access_token private, confirm API calls go to open.feishu.cn, use a test chat for message checks, and understand that enabling external-group use changes the app's Feishu availability after administrator approval.
The manifest description and title are primarily written in Chinese and the skill content consistently assumes Chinese-language interaction, while also embedding some English. There is no indication that the user can choose another language or that the locale restriction is required for compliance or region-specific operation, which can violate language/locale choice policy.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 1. 换取租户凭证（app_id/app_secret 来自开放平台「凭证与基础信息」页）
curl -s -X POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal \
-H 'Content-Type: application/json' \
-d '{"app_id":"cli_xxx","app_secret":"xxx"}'
# → {"code":0, "tenant_access_token":"t-...", "expire":7200}