Security audit

Feishu File Renamer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Feishu filename-restoration tool, but it can rename local files in place from broad chat triggers without a preview or confirmation.

Review before installing. Use only on copied or backed-up Feishu downloads, prefer explicit slash commands, and require your agent to show the exact old and new filenames before allowing any rename. Do not rely on --output-dir, Bitable/message-ID support, or the log as a full rollback mechanism unless the implementation is fixed.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The README says special characters are filtered, but the shown rename logic directly uses `originalName`'s base name without sanitization. If original names come from untrusted message metadata, this can permit unsafe or invalid filenames, causing overwrite/confusion issues, platform-specific path problems, or failures when later tools consume the renamed files.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation phrases are broad natural-language commands like '重命名这些文件' and '恢复文件名', which can be triggered during ordinary chat. In a skill that performs in-place file renaming, ambiguous activation increases the risk of unintended execution on user files without a sufficiently explicit command boundary.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README describes renaming workflows but does not prominently warn that files may be modified in place. For a destructive file operation, insufficient disclosure can lead users to run it on valuable data assuming it is non-destructive, increasing the chance of accidental data handling mistakes or difficult-to-reverse changes.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The natural-language triggers are generic phrases like '重命名文件' and '飞书文件' that could easily appear in ordinary conversation, increasing the chance the skill is invoked unintentionally. Because this skill performs filesystem-modifying actions and supports batch processing, accidental activation could rename many files without clear user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The description highlights batch renaming and automatic conflict handling but does not clearly warn that files may be renamed in place or that large numbers of files can be modified in one run. Users may underestimate the operational impact, leading to unexpected file changes, workflow disruption, or difficulty recovering original names if logs are lost or incomplete.

Static analysis

No suspicious patterns detected.