The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script tools/feishu_mcp_client.py uses subprocess.run to execute npx -y feishu-mcp. This command forces the download and execution of a remote package from the public NPM registry at runtime, presenting a significant supply-chain risk.
[DATA_EXPOSURE]: The tools tools/feishu_browser.py and tools/dingtalk_auto_collector.py contain logic to automatically locate and access the user's local Chrome Profile directory (e.g., ~/Library/Application Support/Google/Chrome/Default). This is used to extract session cookies and bypass security controls like MFA to access internal corporate documents.
[COMMAND_EXECUTION]: The SKILL.md instructions explicitly direct the AI agent to "write a Python script yourself" to interact with Feishu APIs if the provided tools fail. This encourages the agent to generate and execute unvetted code with access to the user's environment and credentials.
[INDIRECT_PROMPT_INJECTION]: The skill represents a large attack surface by ingesting untrusted third-party data (emails, chat histories, and documents) to generate instructions for the AI persona. There is no sanitization or boundary marking to prevent malicious instructions embedded in the source material from poisoning the resulting agent's behavior.
[CREDENTIALS_UNSAFE]: The collector scripts are designed to store and read sensitive credentials, including app_id, app_secret, and user_access_token, in plain-text JSON files located at ~/.colleague-skill/. These files are accessible to any process on the system.
[DATA_EXFILTRATION]: The skill's primary purpose is to aggregate and process large amounts of private data (PII, internal secrets, and private conversations) into local files. While intended for local skill creation, the combination of network access and file system manipulation capabilities poses an inherent exfiltration risk.

colleague-skill