feishu-calendar

The visible skill is purpose-aligned and routes API traffic to Feishu's official domain, with no obvious malicious exfiltration or deceptive data flow. However, its core auth path depends on an unseen local executable script that likely receives Feishu app credentials; under the required scoring rules, that unverifiable credential-handling dependency makes this suspicious and high risk despite otherwise legitimate API usage.