Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed marketing automation guide for Feishu, DingTalk, and WeCom, but users should apply its consent and approval rules carefully before any customer outreach or data syncing.
Install only if you intend to let an agent help operate Feishu, DingTalk, and WeCom marketing workflows. Before running generated commands, verify the target chats, recipients, approval status, opt-in and unsubscribe state, frequency caps, and whether customer data may legally be copied between platforms.
The manifest description says the skill 'Triggers on' phrases such as '多平台营销', 'multi-channel marketing', 'marketing content distribution', and 'marketing dashboard'. These are capability-style phrases rather than narrow invocation terms, and the file does not provide exclusion conditions or negative examples to clarify when this skill should not activate.
The skill’s lead-tracking workflow copies lead data from WeCom into Feishu Base without any explicit consent, legal basis, or minimization step, directly contradicting its own safety rule on cross-platform data sharing. In a marketing automation context, this can expose personally identifiable customer data across systems with different access controls, retention settings, and audiences, creating privacy, compliance, and insider-misuse risk.
The nurture sequence sends multiple scheduled marketing messages to a customer over several days without checking opt-in status, unsubscribe state, or message frequency against prior sends. Because this is an automated customer-facing campaign workflow, omission of these checks can result in repeated unsolicited outreach, policy violations, regulatory exposure, and reputational harm at scale.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
3. **Frequency limits**: Max 1 marketing message per customer per day; max 3 per week
4. **Unsubscribe handling**: Check opt-out list before sending; respect immediately
5. **Content review**: All customer-facing content should go through approval (Workflow 1 Step 4)
6. **Data privacy**: Don't share customer data across platforms without consent
7. **A/B testing**: When testing variants, use separate customer segments
## Prerequisites Check
The skill title and instructions are partly in Chinese and partly in English, and the workflow examples assume China-specific platforms and Chinese-language marketing content. Because the file does not explicitly offer a language/locale choice or document that the skill is intended only for a China-specific context, it can be read as imposing a locale/language preference without user opt-in.
No suspicious patterns detected.