Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Feishu document-sharing workflow, but users should notice that local files may be uploaded to Feishu cloud storage and shared as links.
Before installing, make sure users understand that local documents can leave the local machine by being uploaded to Feishu Drive and then shared as links. Confirm the file and recipient before upload, especially for confidential documents.
The trigger phrases are very broad (for example, common phrases like '发给我' or '发到飞书') and can match routine user requests outside a clearly scoped document-sharing intent. This can cause the skill to activate unexpectedly and initiate uploads or sharing flows involving local documents, increasing the chance of unintended data disclosure or confusing execution in the wrong context.
The workflow instructs uploading local files to Feishu cloud storage and sending direct links, but it does not prominently warn the user that local documents leave the local environment and become cloud-hosted/shareable resources. Without explicit disclosure and consent, users may unintentionally expose sensitive files to third-party storage or broader audiences than expected.
No suspicious patterns detected.
