Security audit
Security checks for vulnerabilities and agentic risk
This skill appears purpose-aligned, but it should go to Review because it writes sensitive health data into Feishu with limited confirmation, privacy, and token-handling safeguards.
Before installing, use a Feishu identity with the minimum required access, keep the config file private, prefer dry-run where available, and review every write/backfill command before running it. Treat the Feishu Base as a third-party store for sensitive health records and avoid using this skill if you need local-only tracking or strict consent/retention controls.
scripts/build_monthly_dashboard.js:52Feishu Base Token Exposed Through Subprocess Arguments and Error Messages
The skill description promises broad health logging, screenshot analysis, and Feishu persistence, but the detected implementation reportedly does much less and behaves differently. This mismatch is dangerous because users and orchestrators may route sensitive health tasks to a skill that cannot safely or correctly perform them, leading to silent failures, misleading outputs, or incorrect data handling assumptions.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- **Conservative Analysis**: Extract only what is visible; do not fake precision.
- **Separation**: Keep analysis facts separate from interpretive suggestions.
## Output rule
Default response shape:
1. Conclusion (what was analyzed/updated)
The README promotes automated persistence of highly sensitive health data to Feishu/Lark but does not warn users about privacy, retention, third-party storage, or consent implications. Because the skill handles meals, sleep, HRV, recovery, and exercise data, silent or poorly explained remote storage can lead to unintended disclosure of personal health information.
The quick-start instructs users to run bootstrap and reporting automation that create tables, logs, and dashboards in Feishu without clearly warning that these commands perform remote writes and modify the user's workspace. This can cause unintentional data creation, exposure, or workspace changes, especially when users treat setup steps as local-only initialization.
The skill advertises shell and file-read capable behavior without declaring any explicit tool scope or permission boundary. In a health-data workflow, undeclared execution and file access increase the risk of overbroad access, unexpected script execution, and unauthorized handling of sensitive personal data.
The skill states that it provides automated Feishu persistence for meals, sleep, and workout data but does not prominently warn users that sensitive personal health information may be stored externally. Lack of explicit disclosure undermines informed consent and can cause users to share highly sensitive data without understanding retention, visibility, or synchronization implications.
Enforcing an English-only schema without user choice or justification can cause inaccurate mapping, loss of meaning, or mishandling of multilingual health data. In a personal-health context, schema coercion may degrade record integrity and create privacy or usability issues if users are not told how their input is normalized.
The universal rule mandates English-only persistence for all users without opt-in, which can silently transform or standardize sensitive health records in ways users did not request. While not a direct exploit primitive, it increases the chance of data quality issues and unexpected processing of personal information.
Line L84 states that the internal schema and persistence layer remain English-only, while non-English input is only supported through external mapping layers. This imposes a fixed language constraint without indicating user opt-in or a clearly documented region-specific justification, which can conflict with organizational language/locale choice policies.
The skill instructs persistence of workout and recovery-related data to Feishu, which can constitute sensitive health information, but it does not warn about external transmission, consent, retention, or data-minimization requirements. In a health-tracking skill, silent export of personal fitness data increases privacy and compliance risk because users may not realize their information is being stored in a third-party system.
The skill explicitly instructs use of a raw write path (lark-cli base +record-upsert) to persist nutrition data, but it provides no warning, confirmation step, or guardrails around modifying an existing persistent record store. In a health-tracking context, silent writes can overwrite or create inaccurate personal records, which may mislead later reports and reduce user control over sensitive data handling.
The instruction to target "English-only" internal schema fields imposes a language constraint in natural language. The file does not offer a language or locale choice, nor does it explain why this restriction is required for a region-specific or compliance-related reason.
The instruction to target "English-only" internal schema fields imposes a language constraint in natural language. The file does not offer a language choice, opt-in, or a clear region/compliance justification for enforcing English-only usage.
Suspicious Unicode normalization or mixed-script content
This script can create remote Feishu tables, views, and fields immediately based on a supplied config and chosen identity, with no interactive confirmation, allowlist, or safety gate beyond an optional dry-run flag. In the context of a health-data skill that manages persistent user records, accidental or unauthorized execution can modify production data structures, create duplicate schemas, or alter the storage surface for sensitive health information.
The locale detection function always returns 'en', which forces English output regardless of user preference or environment. This is a natural-language policy concern because the skill imposes a specific language without opt-in or a documented justification.
This code creates a dashboard in a remote system, and later the script also creates or updates dashboard blocks, but there is no confirmation prompt, warning comment/docstring, or user-facing disclosure before these write operations occur. Because the script modifies remote user data/state rather than only reading it, it should disclose that behavior clearly to the user.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_json(args: list[str]) -> dict[str, Any]:
proc = subprocess.run(args, capture_output=True, text=True, check=True)
return json.loads(proc.stdout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_json(args: list[str]) -> dict[str, Any]:
proc = subprocess.run(args, capture_output=True, text=True, check=True)
return json.loads(proc.stdout)
This script performs bulk remote upserts to a Feishu health calendar using live configuration and records, but it does so immediately when run and without any interactive confirmation, dry-run default, or guardrail around the write scope. In a personal-health skill context, this can silently overwrite or create sensitive health records at scale if invoked with the wrong config, date range, or identity, causing integrity and privacy-impacting mistakes.
The script fixes all date/time parsing and week-boundary calculations to the Asia/Hong_Kong timezone. This imposes a locale-specific interpretation on all users' records without offering a choice or documenting that the skill is intentionally region-specific.
The script aggregates sensitive health data across nutrition, sleep, HRV, fatigue, and exercise tables and persists a derived weekly assessment back into Feishu automatically, with no consent check, confirmation gate, or minimization control in the code path. In a personal-health skill, this increases privacy risk because highly sensitive personal data is being further processed, summarized, and stored in durable form, potentially expanding exposure and retention without the user's explicit approval for each rebuild or backfill.
The README explicitly says the skill uses an 'English-Only Core' and later repeats that it introduces a pure English internal table schema. This is a natural-language locale constraint presented as mandatory, with no opt-in choice or clear justification tied to a region-specific compliance requirement.
The instruction to target "English-only" internal schema fields imposes a language constraint in natural-language guidance. The file does not indicate user opt-in, alternatives, or a justification that this is a required region- or system-specific limitation.
Detected: suspicious.dangerous_exec