Feishu Messaging 0

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This is a documentation-only Feishu messaging skill with expected external API use, but users should confirm recipients and files before sending anything.

Install only if you intend to use a Feishu/Lark bot. Use least-privilege app scopes, protect the app secret, and explicitly confirm the recipient, message text, and exact file path before sending or uploading content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill facilitates external transmission of messages, files, images, and group-member data to Feishu but provides no user-facing privacy notice, consent boundary, or warning about what data leaves the local environment. In an agent context, this increases the risk of unintended disclosure of sensitive content, recipient metadata, or attachments through normal-looking automation.

VirusTotal

66/66 vendors flagged this skill as clean.