Security audit

Feishu Whiteboard V2

Security checks across malware telemetry and agentic risk

Overview

The main whiteboard feature is legitimate, but the bundle includes extra Feishu document and spreadsheet writers and can print an access token, so users should review it before installing.

Install only if you are comfortable giving this bundle Feishu app credentials that can write remote content. Use a least-privileged Feishu app, avoid running get-tenant-token in logged environments, pass only intended temporary files as inputs, and be aware that the bundle contains spreadsheet and document-writing helpers beyond the whiteboard feature.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The file implements Feishu Bitable/spreadsheet creation even though the skill is advertised as a whiteboard/diagram tool. This capability mismatch is dangerous because it expands the skill's effective permissions and data-handling surface beyond user expectations, enabling unintended document creation and content exfiltration into a different Feishu object type.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The createBitable/writeBatch flow adds a non-essential capability for creating and populating spreadsheets from local markdown files, which is outside the stated whiteboard-diagram use case. In an agent context, hidden extra write capabilities are risky because they can be abused to create unauthorized artifacts or shuttle user-provided local content to remote services without matching the advertised intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation description is broad enough to trigger on many common diagram or document-related requests without clearly constraining when the skill should act. Over-broad activation increases the chance of unintended API calls and document modifications in response to ambiguous user input.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description explains the mechanics but does not clearly warn users that it will call external Feishu APIs and modify a Feishu document or whiteboard. Without an explicit warning, users may believe they are only getting generated diagram text rather than authorizing a remote write operation.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script reads a local markdown file and uploads its parsed contents to Feishu via remote API calls, but the help/usage text does not clearly warn users that local file data will be transmitted off-host. In an agent skill, this is more dangerous because users may assume a local transformation for diagram generation, while the actual behavior sends potentially sensitive workspace content to a third-party service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prints the tenant access token directly to stdout in the get-tenant-token path, and elsewhere prints full API responses that may contain sensitive identifiers or tokens. In CLI and agent environments, stdout is commonly captured in logs, transcripts, CI output, or tool telemetry, so this can expose credentials to unintended readers and enable unauthorized Feishu API access until the token expires.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script reads an arbitrary local Markdown file and uploads its contents to a remote Feishu document, but provides no explicit confirmation, warning, or visibility about that data transfer. In the context of a skill advertised for whiteboard generation, this mismatch makes the behavior more dangerous because users may not expect broad document upload capability and could inadvertently exfiltrate sensitive local content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal