Security audit

企业微信智能办公助手

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its office-briefing purpose, but it can automatically collect sensitive workplace data and send it to chat platforms without enough documented controls.

Review carefully before installing, especially before enabling cron or chat delivery. Confirm exactly which WeCom data sources are accessed, which Feishu or WeCom chats receive the report, who can trigger it, and whether redaction, recipient allowlists, approval, and audit logging are configured. Prefer manual runs until automatic delivery and data-minimization controls are clearly set.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill is designed to aggregate sensitive enterprise data including schedules, meetings, todos, and team metrics into a single report, yet the README provides no privacy notice, consent model, data minimization guidance, or access-control constraints. Centralizing these sources increases exposure because a single automated workflow can reveal a much broader operational picture than any one system alone.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The scheduled example explicitly automates generation of a report containing potentially sensitive internal data and sends it to Feishu, which is a separate system from the listed WeCom sources, without any warning or control around cross-system sharing. This creates a real risk of unauthorized disclosure, policy violations, and overbroad distribution if the destination, audience, or tenant boundaries are misconfigured.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manual trigger phrases are broad everyday requests such as asking about schedules or todos, which can cause the skill to activate unintentionally in normal conversation. In this skill, unintended activation is more dangerous because it aggregates multiple sensitive workplace data sources and can generate or send a consolidated report without a clearly scoped user confirmation step.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes automatic daily collection of schedules, meetings, todos, and team smart-sheet data, and sending a rendered report to enterprise chat channels, but it does not warn users about the sensitivity of this data flow or the destinations involved. This increases the risk of silent over-collection, unauthorized sharing to group chats, and exposure of business-sensitive operational information, especially because the skill is designed for automated recurring execution.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manual trigger phrase shown in the use case ("今天的日程") is a common everyday utterance and can easily be spoken in ordinary conversation rather than as an intentional command. In a skill that aggregates potentially sensitive schedule, meeting, todo, and team metrics data, accidental invocation could expose private business information to the wrong chat context or generate unauthorized summaries.

Static analysis

No suspicious patterns detected.