ℹ
Purpose & Capability
The name/description (Feishu knowledge-base query) aligns with the SKILL.md content (search + fetch docs). However the instructions call feishu_search_doc_wiki and feishu_fetch_doc but the skill declares no credentials or required tooling—if these calls require Feishu API access that omission is inconsistent.
!
Instruction Scope
Instructions direct the agent to search, fetch, then '按照知识库中的最佳实践执行' (execute according to the KB). That authorizes the agent to perform tasks based on retrieved docs and even to 'create new Skills' per the guide—this is broader than a pure read-only query tool and could let the agent take substantive actions without clear limits.
✓
Install Mechanism
Instruction-only skill with no install steps or downloaded code; this minimizes on-disk risk and is expected for a simple integration helper.
!
Credentials
No environment variables or primary credential declared, yet the SKILL.md references Feishu-specific operations. If those operations require API tokens or service accounts, the skill fails to request them or explain where they come from (platform-provided connector vs. user-supplied credentials). That gap is disproportionate to the declared requirements.
✓
Persistence & Privilege
always:false and no install/write actions. The skill does not request permanent inclusion or modify other skills/config—no elevated persistence observed.
What to consider before installing
This skill appears to be a Feishu knowledge-base lookup helper, but it leaves two important questions unanswered: (1) how will the agent authenticate to Feishu (API token, service account, or a platform-provided connector)? and (2) how far may the agent act on retrieved instructions (read-only vs. performing tasks or creating new Skills)? Before installing or enabling, ask the skill author or platform: provide the exact auth requirements and token scope (prefer read-only tokens), confirm whether feishu_search_doc_wiki / feishu_fetch_doc are provided by the host or require user secrets, and clarify limits on any 'execute' steps. If you proceed, use least-privilege credentials, enable audit logging for the connector, and test in an isolated account or sandbox first.
