Security audit

飞书日历专业版

Security checks across malware telemetry and agentic risk

Overview

This Feishu calendar skill is mostly calendar-related, but it requests broad file and command authority and can affect shared calendars or send webhook/callback data without clear guardrails.

Review this skill before installing in a real Feishu tenant. Only use it with tightly scoped calendar credentials, confirm every create/update/share/batch action, and avoid enabling arbitrary callback or webhook destinations unless your organization has approved them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill is presented as a Feishu calendar management tool, but its documentation also advertises generic file handling and system command execution unrelated to calendar operations. This scope expansion increases the chance that an agent will invoke powerful local capabilities under a benign calendar pretext, enabling unintended filesystem access or command execution beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Advertising broad file read/parse/write capability is not justified by the stated purpose of enterprise calendar management. In an agent environment, this can cause overbroad tool selection and permit access to local files or workspace content that users did not intend to expose during a calendar task.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill advertises execution of system commands despite being framed as a calendar-management tool. In an agent with exec access, this creates a direct path to arbitrary local actions under weakly bounded natural-language prompts, which can lead to data exfiltration, environment inspection, or destructive operations.

Vague Triggers

High

Confidence: 91% confidence
Finding: The description includes overly broad activation language such as use for AI model calling, agent orchestration, and LLM applications, which extends far beyond calendar management. This makes accidental or inappropriate invocation more likely, especially when the skill also exposes powerful tools like exec, grep, glob, and read.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The natural-language trigger '请帮我创建任务提醒' is underspecified and does not clarify that it may create real calendar entries or affect shared resources. Vague triggers raise the risk of the agent performing write actions without sufficient user understanding or confirmation.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The description highlights shared calendars, collaboration, and write-capable operations but does not clearly warn users that the skill can modify team data and perform batch actions. In enterprise contexts, such omissions can lead to mass calendar changes, permission misconfiguration, or unintended edits to shared schedules.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The webhook feature is described without warning that calendar event data may be transmitted to external endpoints. Since calendar data often contains sensitive meeting details, attendees, times, and metadata, sending it to arbitrary URLs can create privacy, compliance, and exfiltration risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Documenting a callback_url without warning about off-platform transmission can mislead users into supplying arbitrary endpoints that receive results or event data. This creates an avoidable data leakage path, particularly in enterprise workflows where callback targets may not be vetted.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The usage examples perform real calendar creation and shared-calendar membership changes but do not warn that these are write operations against live systems. Users may copy and run them assuming they are harmless demos, causing unintended event creation, permission changes, or notifications.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.