Security audit

ri

Security checks across malware telemetry and agentic risk

Overview

This Feishu document skill is mostly coherent, but it gives an agent broad document overwrite/delete and local-file upload abilities without enough scoping or confirmation guidance.

Install only if you are comfortable letting an agent edit Feishu documents and upload files into them. Before using it, require explicit confirmation for overwrite, deletion, and upload actions, and make the agent name the exact document, block, local file path, URL, and destination before acting.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill documents `file_path` support for uploading local files and images from the host filesystem, which goes beyond normal Feishu document editing and creates a data-exfiltration path from the agent runtime into user-accessible documents. Even if intended for convenience, allowing arbitrary local path reads is dangerous because a prompted agent could disclose sensitive local files, temporary artifacts, or credentials.

Scope Creep

Medium

Confidence: 88% confidence
Finding: The documented ability to read arbitrary local files is not reflected in the listed Feishu/Drive permissions, meaning the effective capability surface is broader than the declared external API scope. This mismatch is risky because reviewers and users may assume the skill only touches Feishu resources, while it can also access host-local data and upload it externally.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation description uses broad phrases like 'cloud docs' or 'docx links,' which can cause the skill to trigger in ordinary conversation that only casually references documents. Overbroad activation increases the chance that document-reading or document-modifying capabilities are invoked without sufficiently clear user intent.

Missing User Warnings

High

Confidence: 96% confidence
Finding: `action: "write"` is explicitly described as replacing the entire document, but the skill provides no user-facing warning or confirmation requirement before destructive overwrite. In an agent setting, this can cause irreversible loss of document contents from an ambiguous or mistaken instruction.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documented `delete_block` operation is destructive, yet the skill does not instruct the agent to warn the user or confirm the target block before deletion. This creates a meaningful risk of accidental content loss, especially when block IDs are obtained through prior tool output and may be easy to misuse.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill allows uploading images from a local `file_path` without warning that this reads from the host filesystem and transmits the data into a Feishu document. That omission makes it easier for an agent to access sensitive local files under the guise of a document operation, especially if users do not realize the runtime has filesystem access.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill supports fetching files or images from arbitrary remote URLs and uploading them into Feishu documents, but it does not warn about privacy, untrusted content, or outbound network access. This can expose internal network metadata, enable retrieval of sensitive third-party content, or cause users to unintentionally transmit externally fetched material into their documents.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.