Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Feishu card integration, but it directs agents to send full thinking and tool logs to an external chat service without adequate redaction or consent guidance.
Install only if you are comfortable granting a Feishu bot card/message permissions and sending selected conversation content to Feishu. Do not configure an agent to publish raw chain-of-thought, full tool logs, secrets, private file excerpts, credentials, or sensitive operational data; use short sanitized progress summaries instead.
This section instructs agents to preserve and stream full internal reasoning/tool logs in external cards, including continuous updates during execution. In the context of an agent integration skill, this is especially dangerous because it operationalizes exfiltration of hidden model reasoning and sensitive intermediate data into a third-party messaging platform, where it may be copied, retained, and shared.
The example explicitly recommends sending '完整思考日志' and tool-call process details to external Feishu cards. Internal reasoning and tool logs frequently contain sensitive user data, secrets, prompts, file paths, or security-relevant context, so exposing them to chat recipients creates a direct data leakage channel.
The skill documents shell commands that use environment variables for app credentials and perform network actions against Feishu, but it does not declare an explicit tool scope or permissions boundary. That omission can cause an agent or operator to invoke networked behavior with sensitive credentials without clear prior authorization, increasing the risk of unintended data transmission or misuse.
The skill explicitly promotes putting 'thinking and tool-calling process' into a Feishu card, but it does not warn that this may expose chain-of-thought, internal reasoning, retrieved sensitive snippets, credentials, or tool outputs to message recipients. In an agent setting, this is especially risky because intermediate reasoning often contains more sensitive material than the final answer.
The documentation says the probe command does not send messages, but it also says the probe creates and updates cards, which are messaging-platform objects and may still generate visible artifacts, consume privileges, or transmit content/metadata to Feishu. This mismatch is dangerous because users may run the command under a false assumption that it is side-effect free or non-communicating.
The workflow instructs users to send cards, updates, text, titles, and receive identifiers to Feishu, but it does not prominently warn that these commands transmit content and metadata to an external service. Without that disclosure, an agent may forward sensitive operational data, user identifiers, or conversation content off-platform without informed consent.
The card title contains fixed Chinese text ('战果') and there is no indication in this file that the language is selectable or tied to a documented region-specific requirement. This can violate language/locale policy by imposing a specific language on all users without opt-in.
The skill includes a list_chats capability that enumerates all chats the bot is a member of, which exceeds the core purpose of rendering and updating Feishu cards. In an agent setting, this broadens access to organizational metadata and can leak conversation names/IDs that may be sensitive or enable follow-on targeting, especially if exposed to downstream tools or logs.
The card title text is hard-coded in Chinese ("思考和工具调用过程") with no indication that the skill is region-specific or that users can choose a language. This can violate language/locale policy when a skill imposes a specific language on all users without opt-in.
The probe claims it 'does not send messages' and 'does not disturb users', but it still creates a remote CardKit card object on the Feishu service. While it does not post to a chat, this mismatch can cause unintended remote side effects, leave residual test artifacts, and mislead operators about what the command does during security review or change control.
