Security audit

Workspace

Security checks for vulnerabilities and agentic risk

Overview

The video analyzer itself is mostly coherent, but the package also installs a broad, under-disclosed Lark/Feishu automation workspace with cloud write, permission, messaging, calendar, and long-running event capabilities.

Install only if you intentionally want a broad Lark/Feishu workspace automation bundle, not just a video-content analyzer. Before use, review and remove unrelated nested skills, limit lark-cli scopes, avoid broad bot permissions unless needed, protect Supabase service-role credentials, and confirm where extracted frames and reports may become visible.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (347)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The main Python workflow matches the declared description well: it processes single videos and directories, extracts frames, performs web search, stores records in Supabase, and publishes to Feishu Wiki with category grouping. However, the repository also contains significant additional functionality not represented in the description: a full Lark Slides template-tooling subsystem and an XML overlap linter, plus a separate Feishu Wiki shell script for listing spaces/nodes and creating a meeting-notes page. Those are materially different capabilities and are not merely implementation details of video analysis, so this should be flagged as a mismatch.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The directive at L03 states a local-only operating constraint, but later instructions explicitly require use of scheduling and watch mechanisms that imply external system interactions beyond project-local files. This is an active contradiction in the file's operational guidance, not merely an omitted detail.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest describes a video-content-analyzer that should turn video analysis results into searchable documentation, but this file performs standalone Feishu Wiki space enumeration and creates a hard-coded page titled '会议纪要' with placeholder content. That is more than an implementation detail: the script's actual behavior is not tied to video content, extracted keyframes, search results, or report publication from analysis output.

Intent-Code Divergence

Low

Confidence: 74% confidence
Finding: The top-level comment describes 'Wiki 空间读取 + 创建页面 + 写入内容', which suggests operating on a chosen Wiki space, but the implementation first discovers accessible spaces and implicitly uses the first returned space. That behavior changes the operational intent from acting on a specified destination to probing available spaces and auto-targeting one.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest describes a skill for analyzing videos, searching the web, storing results in Supabase, and publishing reports to Feishu Wiki. This file instead documents creating and updating calendar events, checking attendee free/busy status, searching meeting rooms, and modifying recurring meetings, which is a fundamentally different behavior domain.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest describes a skill focused on video analysis, web reference search, Supabase storage, and Feishu Wiki report publishing. This file instead defines a general-purpose `docs +create` capability for creating arbitrary Feishu documents from XML or Markdown, which is broader than merely publishing analysis results and represents a different operational scope.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: A video-content analysis skill may reasonably publish finished reports, but this file exposes a standalone document-authoring interface with format-selection logic and unrestricted content creation examples. That is a general document editing capability, not an obvious requirement of extracting keyframes, searching references, storing results, or publishing analysis outputs.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The manifest mentions publishing reports to Feishu Wiki, but does not indicate that the skill may alter document permissions or grant administrative access. Automatically assigning `full_access` is a materially different behavior from simply publishing a report and changes resource access semantics.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest describes a skill for analyzing video content, searching the web, storing results in Supabase, and publishing reports. This file instead documents a command for inserting clipboard/local files into Feishu documents, including direct document modification behavior unrelated to video analysis.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest describes a skill for analyzing video content, extracting keyframes, performing web searches, storing results in Supabase, and publishing reports to Feishu Wiki. This file instead documents `docs +search` for searching Lark cloud documents, Wikis, sheets, folders, and related objects, with no video-processing behavior at all.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest says this skill analyzes video content, searches the web, stores results in Supabase, and publishes reports to Feishu Wiki. This file instead instructs agents to create and iteratively edit Feishu documents, spawn subagents, and manipulate whiteboards, with no video-processing behavior at all.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The manifest justifies analyzing videos and publishing results, but this guidance adds a generalized orchestration pattern where agents and subagents independently write document sections and whiteboards. That broad authoring/orchestration capability goes beyond what is needed to describe a video-content analyzer and is presented as a reusable workflow for document creation from arbitrary topics.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: These lines describe identifying diagram opportunities, inserting SVG whiteboards, and invoking a separate whiteboard skill to populate complex boards. Creating arbitrary diagrams and whiteboards is a broader content-authoring capability that is not justified by a manifest centered on extracting keyframes, web references, database storage, and wiki publication.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest says this skill analyzes video content, searches the web, stores results in Supabase, and publishes reports to Feishu Wiki. This file instead documents a Lark document editing workflow: fetching document sections, rewriting content, updating blocks, inserting whiteboards, and spawning agents to edit docs and boards. Those operations are a materially different capability from video analysis and searchable documentation generation.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The workflow tells agents to run `docs +update`, insert callouts/tables/whiteboards, overwrite sections, and use a separate whiteboard skill to write into boards. Direct collaborative document rewriting and whiteboard authoring are not inherent requirements of analyzing videos and publishing reports, especially when the manifest only frames Feishu Wiki as an output destination rather than a general-purpose editing surface.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest for video-content-analyzer is about analyzing videos, storing results, and publishing reports; it does not suggest changing access control on unrelated cloud documents. This file explicitly states that after import, the CLI may automatically grant the current user manage-level permissions on the created resource, which is a materially broader behavior than simple import/conversion.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Granting ACL/permission changes to cloud resources is a distinct administrative capability. For a skill whose stated purpose is video analysis, web reference lookup, database storage, and wiki publishing, silently elevating a user's access to imported Drive resources is not an obvious or necessary capability.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This reference file is for importing Word, Markdown, TXT, HTML, Excel, CSV, and Base snapshot files into Lark Drive/Docs. That behavior does not match the manifest's declared purpose of analyzing video content, searching the web, storing results in Supabase, and publishing reports to Feishu Wiki.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The file presents this shortcut as a unified interface to query asynchronous task results, but the IMPORTANT note states that in import scenarios it may also perform a write action by granting the current CLI user full_access on the resulting document. That is a semantic mismatch between a read-style result-query command and an access-modification side effect.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The permissions table says the import scenario requires only `drive:drive.metadata:readonly`, which implies a read-only operation. However, the note and earlier IMPORTANT section state the command may attempt collaborator authorization and grant `full_access`, directly contradicting the read-only framing of the documented intent and required scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest and document framing describe an email skill for drafting, sending, reading, searching, and managing mail-related resources. This section adds a separate capability to send cards into IM chats, requiring IM scopes and chat lookup, which is not necessary to fulfill the stated email-management purpose.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented command is presented as creating a native Markdown file in Drive, but the IMPORTANT section states that when run as bot, the CLI also attempts to grant the current CLI user full_access management permission on the created file. That is an additional permission-management side effect, not merely a file-creation detail, and it materially broadens the operation described in the command overview.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The stated purpose of this skill file is to create a Markdown file in Drive. Automatically assigning the current CLI user manage-level access is an access-control management capability, which is distinct from content creation and is not clearly necessary from the stated purpose alone.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Line L004 says the skill supports '获取妙记相关 AI 产物（总结、待办、章节）', implying those capabilities belong to this skill. However, L049-L062 and L092-L100 explicitly state transcripts, summaries, todos, and chapters are '不属于本 skill' and must be fetched via `vc +notes`, which is an active contradiction in the documentation.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: skills/lark-mail/SKILL.md:32