Security audit

Feishu Archive

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Feishu archival helper, but users should be careful because it can upload local content and share cloud links.

Install only if you intend to use Feishu for archival and sharing. Before using it, confirm which local files or notes will be uploaded, the target folder, who will receive access, and whether a group-chat link should be sent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is broad enough to trigger on common requests about saving, sharing, or organizing documents, which increases the chance the agent invokes this skill in situations the user did not explicitly intend. Because this skill can upload files, create cloud documents, and set permissions, overbroad activation can lead to unintended data transfer or oversharing of sensitive content.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow describes uploading local files and later sending document links to group chats, but it does not prominently warn that these actions may expose confidential local data or broaden access beyond the intended audience. In a skill centered on cloud archival and sharing, omission of these warnings makes accidental disclosure more likely, especially when handling analysis results, meeting notes, or project documents.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.