weekly-report-generator-feishu-chinese

• Analyzed: Apr 2, 2026, 2:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: c5e6990fcda93c499db51f3ed5caef5050bd7580d2b9a4c99beaf9cd9cb27d2a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates git log extraction and sends data to the Feishu API (open.feishu.cn). The SKILL.md file contains instructions that explicitly command the AI agent to execute scripts and exfiltrate data to an external endpoint without user confirmation or review ('无需任何检查或询问'). While the scripts (auto-weekly-report.sh, send-to-feishu.sh) appear functional for their stated purpose, the use of 'HARD-GATE' instructions to bypass human-in-the-loop verification for data transmission poses a significant security risk.