Security audit

Feishu Doc Tool Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with Feishu document automation, but it needs Review because it can change remote documents, run local commands, use app secrets, and accept arbitrary callback URLs without clear safeguards.

Install only if you intend to let the agent access and potentially modify Feishu content. Use a dedicated low-privilege Feishu app, provide secrets through a secure environment mechanism rather than chat, confirm every create/append/modify/delete/export action, and avoid arbitrary callback URLs unless you fully trust the destination.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill documents a generic callback_url input for asynchronous completion, but this capability is unrelated to the stated Feishu document operations and creates a path for sending data or status to arbitrary external destinations. In an agent context, such open-ended callback behavior can enable unintended data exfiltration, SSRF-like outbound requests, or abuse of internal network reachability if the URL is not tightly constrained.

Context-Inappropriate Capability

Low

Confidence: 78% confidence
Finding: The documentation instructs use of ping and other network-diagnostic shell activity that is not necessary for normal Feishu document handling. In a skill that already advertises exec capability, encouraging unrelated shell/network commands broadens operational scope and can normalize command execution that may probe networks or leak environment details.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The skill is presented as a limited free/basic Feishu document tool, but the documentation expands behavior to generic create/query/export/modify/delete modes. This scope creep increases the chance that an agent will perform destructive or overbroad actions that users did not expect from the manifest, especially because write and exec are enabled.

Description-Behavior Mismatch

Medium

Confidence: 75% confidence
Finding: The description expands the skill from Feishu docs/Wiki into spreadsheets and multidimensional tables without clearly reflecting that scope in the manifest's core capability statement. While this is likely documentation drift rather than an exploit by itself, such mismatch can cause the agent to request broader permissions or process more sensitive data types than users expect.

Vague Triggers

Medium

Confidence: 73% confidence
Finding: The example trigger phrases are broad, natural-language requests such as reading documents or generating reports, which can overlap with ordinary conversation. In agent ecosystems, overly generic triggers increase the risk of accidental invocation of document creation or modification workflows, especially for a skill with write and exec capabilities.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill advertises document creation, writing, appending, block operations, and exec support but provides no meaningful safety notice about data modification or command-execution risk. In this context, the lack of warnings makes the skill more dangerous because users may not realize that routine prompts could alter remote documents or trigger local command execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to configure App ID, App Secret, and environment variables but omits any credential-handling, logging, or privacy guidance. In an agent setting, this can lead to secrets being pasted into prompts, echoed in logs, or exposed through command output, resulting in compromise of the connected Feishu tenant or related services.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.