Feishu Room Booking 3.2.0

• Outcome: Review
• Latest audit: Sep 5, 2026 · 3:45 AM UTC
• Version: 3.2.0

Overview

The skill is a coherent Feishu meeting-room helper, but it can automatically scan calendars and reserve rooms without per-action confirmation, so it should be reviewed carefully before installation.

Install only if you are comfortable granting this skill Feishu calendar read/write, attendee-read, and free/busy access. Before enabling Heartbeat or using backfill/waitlist features, confirm you want the agent to reserve rooms later without asking again, and avoid bulk preference listing unless you have an administrative reason.

A.I.G

By Tencent

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes shell commands and reads/writes multiple local JSON files, but it does not declare any permissions boundary for those capabilities. That creates an authorization transparency gap: users and the hosting platform cannot clearly evaluate that the skill can inspect calendar data, persist preferences/waitlists, and modify state through shell-invoked tools.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The `--list` action enumerates all stored users' meeting-room preferences, exposing user identifiers and preference metadata beyond a single user's self-service scope. In an agent skill handling employee scheduling data, this creates unnecessary internal data exposure and enables broad harvesting of coworker behavior or location preferences.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section authorizes the agent to scan future events and automatically book rooms for meetings missing a confirmed resource, explicitly skipping user confirmation in the backfill path. Because it can modify the user's calendar and reserve shared resources based on inferred defaults, mistakes in event interpretation, building selection, or attendee visibility can cause unintended bookings and calendar changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The waitlist workflow allows background polling to detect availability and then submit room bookings automatically, again without a strong disclosure boundary or per-action approval. This can cause the agent to take autonomous actions on the user's behalf after the original interaction has ended, reserving scarce resources unexpectedly or contrary to changed user intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This finding appears to be a true issue because the building alias includes an overly broad token that can collide with many unrelated user references. In a room-booking skill, ambiguous aliases can cause misrouting to the wrong building and expose room metadata or enable unintended bookings in another location, especially when the skill auto-resolves buildings from natural language.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: This is also a true vulnerability: the alias at this location is overly broad/ambiguous and can match common user utterances unrelated to the intended building. Given this skill books real meeting rooms, ambiguous resolution increases the risk of booking the wrong room, leaking occupancy information for another office, or causing operational disruption through mistaken reservations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Bulk listing of all users' preferences discloses identifiers and potentially sensitive workplace preference data without warning or consent boundaries. In this skill context, meeting-room and building preferences can reveal employee habits, team locations, or movement patterns, making the exposure more sensitive than generic app settings.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to enumerate upcoming calendar events, fetch attendee details, and persist the results as JSON for downstream processing, but it does not define a per-run consent boundary or minimization controls. Persisting structured event and attendee data increases privacy risk, especially if the stored JSON includes sensitive meeting metadata, participant identities, or meetings unrelated to the immediate user request.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.