网页转飞书文档 Pro

PassAudited by ClawScan on May 14, 2026.

Overview

This appears to be a coherent Feishu document-saving skill, but it uses Feishu credentials and can persist user-provided web or file content to cloud documents.

Before installing, make sure you are comfortable giving the skill Feishu document-creation access, configure a least-privilege Feishu app, and confirm where converted webpages or files will be saved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Installing users may need to grant the agent access to a Feishu app that can create documents in their workspace.

Why it was flagged

The skill requires Feishu app credentials to create cloud documents; this is expected for the stated purpose, but the supplied metadata says no required env vars or primary credential.

Skill content

export FEISHU_APP_ID="your_app_id"
export FEISHU_APP_SECRET="your_app_secret"

Recommendation

Use a least-privilege Feishu app, store secrets only in environment variables, and confirm the app can write only to intended spaces or folders.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A user-requested conversion can result in a new persistent document being created in a Feishu space chosen by the skill’s routing rules.

Why it was flagged

The skill may create Feishu documents after automatic classification. This matches the save-to-Feishu purpose, but it is still a cloud-write action.

Skill content

如内容特征明确且知识库存在 → 直接创建
...
使用 `feishu_create_doc` 创建文档

Recommendation

Review or configure the default Feishu space and folder, and ask the agent to confirm before saving if the destination matters.

Low

#ASI06: Memory and Context Poisoning

What this means

Private files or untrusted webpage content may become stored in Feishu and could later be read as reference material.

Why it was flagged

The skill can turn arbitrary web pages or selected local files into persistent Feishu knowledge-base documents, preserving untrusted or sensitive source content.

Skill content

支持的信源：... 任意 HTML 网页
- 本地文件：PDF、Word、PPT、Excel、图片、音频等

Recommendation

Only submit content you intend to store in Feishu, keep source metadata visible, and avoid treating imported webpage text as trusted instructions.