Security audit
Security checks for vulnerabilities and agentic risk
The skill is an openly documented Feishu/Lark CLI reference, but it includes high-impact migration, scraping, and bulk deletion workflows that should be reviewed before use.
Install only if you intentionally need Feishu/Lark migration and cleanup commands under your own account. Do not use the scraping or browser-automation fallbacks to copy content unless you are explicitly authorized to export or migrate it, and treat the bulk delete examples as destructive operations requiring a dry run and a verified target list.
This section presents a deliberate fallback workflow for when API copy is forbidden: scrape readable web content into Markdown and re-import it elsewhere. That directly circumvents normal copy/export restrictions and enables data transfer through an alternate channel, undermining platform controls intended to limit duplication and exfiltration.
The browser-automation section explicitly suggests extracting visible text/HTML from authenticated document pages and even triggering UI-based 'create copy' actions. This creates a practical natural-language exfiltration path from any page readable in the user's session, especially dangerous in a skill focused on bulk, cross-tenant operations under user identity.
The skill includes executable guidance and sample code to bulk-delete wiki child nodes using the logged-in user's identity, but it does not provide a prominent warning about irreversible or large-scale data loss. In this context, the omission is dangerous because the skill is explicitly designed for batch operations, making accidental destructive use much more likely.
The browser automation fallback recommends connecting to a logged-in browser session and extracting visible document text/HTML, but it does not clearly warn that this may collect sensitive content from documents accessible under the user's session. Because the skill centers on cross-space and cross-tenant document handling, this creates a meaningful privacy and data-handling risk.
No suspicious patterns detected.
