Feishu Progress Heartbeat

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.1.0

Overview

This skill is a visible Feishu progress-update helper for long-running tasks and does not include executable code, hidden installation behavior, credential use, or destructive actions.

Install this if you want agents to post periodic Feishu status updates for long-running delegated work. Before enabling it broadly, confirm that users expect automatic heartbeat messages in the relevant conversations and that Chinese status wording is appropriate for the workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill’s activation guidance is broad enough that it could trigger in many Feishu long-running task scenarios without tight scoping or exclusion criteria. That increases the chance of unintended invocation, causing unsolicited status messages, workflow interference, or leakage of task existence/progress into a conversation where heartbeat behavior was not explicitly desired.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The reply format and examples are effectively fixed to Chinese, with no language negotiation or stated locale constraint. In a multilingual environment this can produce misleading or unusable status updates, increasing operational error risk and making users miss blocker or failure notifications.

VirusTotal

66/66 vendors flagged this skill as clean.