The Agent Skills Directory

[DATA_EXFILTRATION]: The skill defines a process for sending files to the Feishu platform using the feishu_media tool with the upload_and_send_file action. It explicitly requires the use of 'absolute paths' for the file_path parameter without providing any instructions for validation or restriction to a secure workspace. This capability can be misused to access and exfiltrate sensitive files from the underlying system (e.g., .env, /etc/passwd, or .ssh directories).
[DATA_EXFILTRATION]: The skill lacks sanitization and boundary markers for processing external data. Since the file_path and destination IDs (chat_id, open_id) are often derived from user input or external data, the absence of verification steps in the instructions allows for a potential attack surface where an agent might be manipulated into sending unintended files to an attacker-controlled Feishu destination.

feishu-im-file-send