Security audit

feishu-group-memory-system-飞书群聊记忆管理

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed group-chat memory tool, but it gives chat content lasting influence through broad persistence and an unsafe text-command channel.

Install only if all Feishu group participants are comfortable with discussions being summarized into local memory and daily diary files. Before use, remove or tightly restrict the [SYSTEM] command handling, disable heartbeat auto-save unless explicitly needed, and add clear rules for consent, redaction, retention, review, and deletion of stored chat content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest and description frame the skill as group-chat memory persistence, but the body also routes private-chat content into a daily diary. This creates a scope mismatch that can cause operators and users to underestimate what data is being persisted, leading to unexpected retention of private conversations.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The private-chat routing text says the environment is only being identified and routed, yet it also states the current private conversation will be recorded to a diary. That discrepancy can result in silent persistence of sensitive 1:1 content under the guise of simple routing, violating user expectations and increasing privacy risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill enables automatic loading and saving of group memory at session start and heartbeat time without a clear user-facing privacy notice or consent flow. Automatic persistence of chat context can capture sensitive business or personal information from group discussions and retain it beyond participants' expectations.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The instructions require writing actual group conversation content, decisions, and progress into the user's daily diary. This copies data from a group context into another persistent context, greatly increasing the chance of unauthorized disclosure, accidental reuse in unrelated sessions, and over-retention of third-party information.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The file explicitly instructs users to record Feishu group chat IDs in a persistent markdown reference. Even if chat IDs are not secrets by themselves, they are internal identifiers that can reveal organizational structure and create an unnecessary inventory of collaboration targets, which becomes useful to an attacker if the repository is exposed.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Recording actual group conversation content in a daily diary creates a natural-language data leakage path across contexts. Information from one group can later surface in unrelated personal summaries or other sessions, exposing confidential or third-party content outside its original audience.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The workflow reads full session history and writes summarized contents to persistent storage and logs. While persistence is the feature's purpose, saving broad summaries of conversation history without minimization or classification can preserve secrets, personal data, or internal discussions that should not be retained.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.