Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent and not malicious, but it asks users to pre-authorize persistent Feishu download and read scopes beyond what every task needs.
Install only if you are comfortable granting Feishu/Lark document read and file download permissions to lark-cli. Prefer authorizing scopes only when the specific task needs them, download into a dedicated folder, and review how to revoke Feishu/Lark authorization after use.
SKILL.md:158Persistent Blanket Authorization Exceeds Least-Privilege Requirements
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: feishu-doc-pipeline
display_name: Feishu Wiki Doc Pipeline
slug: feishu-doc-pipeline
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: feishu-doc-pipeline
display_name: Feishu Wiki Doc Pipeline
slug: feishu-doc-pipeline
The README explicitly frames the skill as downloading attachments to the local disk but does not warn that it will write files onto the user's machine, potentially consuming storage or placing untrusted content locally. In a skill context, missing disclosure around local file writes can lead users to authorize or run actions without understanding that remote content will be persisted to disk.
A language/locale policy issue applies when a skill forces a specific language without user opt-in. This file is bilingual rather than explicitly forcing one language, but it also does not state that users may choose their preferred language for interaction or output.
No suspicious patterns detected.