Security audit

Feishu Multi Agent Messaging

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Feishu messaging skill; its main risk is that users must handle real chat recipients, bot secrets, and user IDs carefully.

Before installing, confirm you are comfortable configuring Feishu bot credentials and maintaining per-bot open_id mappings. Treat appSecret values, open_id mappings, message contents, and screenshots/logs containing them as sensitive; verify accountId and recipient IDs before sending private messages or group @mentions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README gives concrete instructions for sending private and group messages, including @-mentions with raw open_id values, but does not warn about privacy exposure, misdelivery risk, or leakage of user identifiers in logs, docs, screenshots, or group chats. In this skill’s context, the risk is heightened because it explicitly manages cross-bot identity mapping, so mishandling these identifiers or message targets can expose personal data or send sensitive content to the wrong recipient.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly promotes cross-bot user ID mapping and status sharing in group/private messaging flows, but it does not mention consent, data minimization, access controls, or retention limits. In a multi-agent chat setting, exposing per-bot open_id mappings and broadcasting workflow status can leak identity correlations and user activity across bots or groups, creating avoidable privacy and metadata exposure risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill documentation is written in Chinese and does not indicate that language selection is optional or that the scope is intentionally limited to Chinese-speaking users. Per the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document title and all instructional content are written exclusively in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documentation explicitly instructs operators to send group/private chat messages and use Feishu user open_id values, but it does not mention privacy expectations, consent, retention, or the sensitivity of identifiers. In a multi-agent messaging skill, this omission can normalize unnecessary exposure of user identifiers and task details across bots and chats, increasing the risk of privacy leakage or misrouting messages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file provides multiple examples of sending direct messages, group messages, and @mentions to users in Feishu, including using user and group identifiers, but it does not warn readers that these actions will contact real recipients and may expose task details or personal identifiers. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire template, headings, instructions, and examples are written only in Chinese, which imposes a specific language on users. There is no indication that this skill is region-specific or that alternative language support is optional, so it appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language description and instructions are entirely in Chinese, which can amount to a language-policy issue when a skill forces a specific language without user opt-in. There is no indication that the skill is region-specific or that alternative language support is intentionally constrained and documented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The document presents the workflow entirely in Chinese and frames it as the required collaboration process, with no indication that users may choose another language or that the locale restriction is intentional and justified. The policy for SQP-3 calls out forced language or locale constraints without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document forces a specific language/locale in its instructions and examples, with no indication that users may choose another language or that the Chinese-only presentation is required for a region-specific purpose. Under SQP-3, language or locale policy violations should be flagged when a skill forces a language without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON config includes fixed Chinese bot names ("码农" and "审核老师") as user-facing labels. Because SQP-3 applies to all file types, this is a natural-language locale choice embedded in configuration with no indication that users can select another language or that the deployment is intentionally Chinese-only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.