ClawHub
Back to skill

Security audit

feishu-calender

Security checks for vulnerabilities and agentic risk

Overview

This Feishu calendar skill is mostly purpose-aligned, but it exposes event update/delete and ongoing calendar monitoring without enough user-control or disclosure guardrails.

Review this skill before installing if it will run with real Feishu calendar credentials. Only use it where agents must be allowed to create, update, delete, and monitor calendar events, and add operational guardrails requiring explicit confirmation before deleting or modifying events and explicit opt-in before enabling subscriptions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
84% confidence
Finding

The documented DELETE endpoint enables irreversible destructive action against calendar events, and the skill provides no stated safeguards such as confirmation, ownership checks, or rollback guidance. In this context, a scheduling skill is expected to manage events, but deletion is more dangerous because misuse or prompt confusion could cancel meetings, disrupt operations, and affect multiple attendees.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

4. 删除日程

text
DELETE /open-apis/calendar/v4/calendars/:calendar_id/events/:event_id

Scope Creep

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The declared permissions do not clearly communicate that the skill can update or delete events, while the body documents those actions. This mismatch can mislead reviewers and users about the true operational scope, weakening security review and consent because destructive calendar actions may be assumed absent or unsupported.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documentation advertises update and delete event operations that are not reflected in the top-level scoped description, creating capability drift between what a user may expect and what the skill can actually instruct an agent to do. In an agent setting, undocumented destructive actions like event deletion increase the risk of unintended or unauthorized schedule modification because users are not adequately warned about the full action surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages subscribing to calendar changes and webhook-based monitoring without a prominent warning that this enables ongoing observation of users' scheduling activity. Calendar metadata can reveal sensitive behavioral, organizational, and availability information, so omitting disclosure reduces informed consent and increases privacy risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.