Security audit
Security checks for vulnerabilities and agentic risk
This is a Feishu messaging helper with disclosed API examples, but users should confirm any message, image, or file before sending it.
Install this only if you intend to use a Feishu bot for messaging, chat lookup, and uploads. Confirm recipients, message contents, and exact files before sending; keep APP_ID and APP_SECRET secure; avoid debug logging sensitive responses in production. Do not rely on it for document creation unless you add or verify that workflow yourself.
The manifest description and usage scope emphasize sending Feishu messages, with trigger scenarios around finding chat/member IDs and retrying failed sends. However, the skill documentation also includes image upload, file upload, and an overview that says it can create documents and manage Feishu resources, which expands the behavior beyond a narrow messaging workflow.
The natural-language description, trigger examples, and usage instructions are entirely in Chinese, with no indication that other languages are supported or that Chinese is a deliberate, justified locale restriction. Under the policy, forcing a specific language without user opt-in is a reportable natural-language policy issue.
The skill documents APIs for sending messages and uploading images/files to Feishu without warning that user-provided text and local files may be transmitted to an external service. In an agent setting, this omission can lead to unintended exfiltration of sensitive data, especially if the agent uses local files or forwards content without clear user confirmation.
The manifest says the skill supports '消息发送与文档创建工作流', and the title/overview repeat document-related functionality. But the concrete code examples only cover chat lookup, message sending, image upload, file upload, and chat member queries; no document creation API usage is shown.
