ClawHub
Back to skill

Security audit

飞书知识库 AI 管家

Security checks across malware telemetry and agentic risk

Overview

This is a Feishu/Lark Wiki management instruction skill with disclosed search and node-editing behavior and no executable installer or hidden persistence.

Install this if you want an agent to help manage Feishu/Lark Wiki spaces. Use an account with only the permissions needed, review search scope before broad searches, and confirm create, move, or rename plans before execution; do not rely on this skill for permission changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list is very broad and includes generic knowledge-management terms such as document search, knowledge management, and navigation. In an agent environment, this can cause the skill to activate for loosely related user requests and take over routing or tool use unexpectedly, increasing the chance of unintended data access or actions in Feishu Wiki.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.