Security audit
Security checks for vulnerabilities and agentic risk
This is a narrow Feishu help skill that explains how to make real @ mentions using rich-text messages, with no hidden code or persistence.
Before installing, understand that the skill may guide your agent to look up Feishu user identifiers from group members or message mentions so a real @ notification can be sent. Use it only where your Feishu integration is allowed to access that identity information.
The example payload hard-codes the zh_cn locale in the post content, which is a natural-language locale constraint. The skill does not offer an alternative locale or explain that this is merely an example, so it can steer users toward a fixed language/locale without opt-in.
The recommended template again embeds zh_cn as the locale key, presenting a fixed-language output pattern. Because the document gives this as the default answer template and does not mention locale selection, it violates the language/locale choice policy.
No suspicious patterns detected.
