Security audit

Feishu Workflow CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Feishu/Lark workflow automation, but it gives agents broad authenticated business automation powers with weak confirmation and privacy guardrails.

Install only if you are comfortable with an agent helping operate an authenticated Feishu/Lark account. Review recipients, meeting authorization, approval actions, and any cross-platform sends before execution; prefer a minimally privileged account and a pinned, reviewed CLI version in an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Unpinned Global Installation and Automatic Update of an npm Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill includes guidance for joining meetings and monitoring meeting events, which are highly privacy-sensitive operations, but it does not require explicit participant consent or a prominent warning about surveillance and recording implications. In workflow automation context, this is especially dangerous because an agent could normalize or automate access to live meetings and event streams containing confidential discussions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow automates sending reports through email and team chat, potentially distributing operational data, links, or summaries to broad audiences without an explicit warning about confidentiality, external recipients, or over-sharing. Because the skill is designed for chained automation, a small mistake in recipient selection or content review can quickly lead to organizational data leakage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The decision framework activates on very broad Feishu-related requests and quickly maps them into workflow execution patterns. In an agent setting, overly broad triggering can cause the skill to engage for ambiguous requests and propose or initiate high-impact actions such as messaging, mail, approvals, or meeting access without sufficiently narrow scoping.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is presented as Feishu/Lark-focused, but it embeds directly executable cross-platform messaging commands instead of strictly delegating those actions. That increases the operational scope beyond what a user may expect and can cause an agent to send data to external platforms or unintended recipients without platform-specific consent and review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill says cross-platform work should be delegated, but elsewhere provides a concrete dws ding send example. That contradiction weakens guardrails and makes it more likely an agent will bypass intended boundaries, leading to accidental data propagation across communication systems.
Content: No source excerpt is available for this finding.