Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a normal Feishu calendar availability helper, but it can query other people's availability and documents meeting creation without clear consent or scoping safeguards.
Install only if you are comfortable with the agent checking Feishu free/busy information for coworkers and potentially using calendar event creation tools. Use it for legitimate scheduling only, and require explicit user confirmation before querying multiple people's calendars or creating any meeting.
The description emphasizes checking attendees' availability but does not warn that querying others' calendars involves potentially sensitive scheduling metadata. Without a privacy notice or consent guidance, users and agents may treat this as harmless, leading to overbroad or inappropriate access to coworkers' free/busy information.
Broad trigger phrases like everyday availability questions can activate the skill in situations where the user did not intend a calendar query. Because the skill accesses other users' free/busy information, accidental activation may expose availability data or cause unnecessary lookups without clear user intent.
The skill is presented as a conflict detector, but the quick reference also documents a meeting-creation capability. This scope expansion can cause an agent or user to invoke calendar write actions when they expected a read-only availability check, increasing the risk of unintended side effects such as unauthorized or accidental meeting creation.
No suspicious patterns detected.
