feishu-routing

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Feishu group-chat routing skill that forwards messages from four specific chats to named agents and relays their replies.

Install only if the listed Feishu chats and mapped agents are trusted to receive the original group messages and produce replies that may be relayed back automatically. Avoid using it in chats containing secrets or sensitive internal content unless you add redaction, consent, and review controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly forwards raw group chat contents and chat context to sub-agents via `sessions_spawn`, but does not describe any consent, minimization, access control, or redaction requirements. This creates a real data-sharing/privacy risk because messages from one chat may be exposed to other agents that may not need full content and may have different permissions or prompt behavior.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal