skills/bighardperson/computer-science-skills-collection/feishu-calendar-advanced/Gen Agent Trust Hub
feishu-calendar-advanced
Fail
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading the @teamclaw/feishu-agent package from an external registry using the bunx command during setup and use.- [REMOTE_CODE_EXECUTION]: Instructions explicitly call for the execution of code from the @teamclaw/feishu-agent package, which is not from a known trusted vendor, allowing for potential arbitrary code execution.- [INDIRECT_PROMPT_INJECTION]: The skill processes external calendar data that could contain malicious instructions intended for the agent.
- Ingestion points: Fetches calendar summaries and event descriptions from the Feishu API in the 'calendars' and 'events' commands.
- Boundary markers: There are no delimiters or 'ignore' instructions implemented to prevent the agent from following directions found within event data.
- Capability inventory: The skill can perform modifications to the user's account, such as creating and deleting events.
- Sanitization: No data sanitization or validation of external event content is performed before processing.
Recommendations
- AI detected serious security threats
Audit Metadata