feishu-cli-meetings
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute feishu-cli commands for searching meetings, downloading media, and managing meeting bots.
- [INDIRECT_PROMPT_INJECTION]: The skill processes meeting transcripts and AI-generated summaries which are sourced from external meeting participants. * Ingestion points: meeting transcripts, AI summaries, and meeting titles fetched via vc notes and vc detail in references/workflows/vc/workflow.md. * Boundary markers: The skill instructions do not explicitly define boundary markers for the agent when processing this data. * Capability inventory: Shell execution via feishu-cli, file write access for downloading transcripts and media, and network access for API calls. * Sanitization: Documentation mentions filename sanitization and SSRF protection (checking for localhost, internal IP ranges, and protocol downgrades) during media downloads.
- [DYNAMIC_EXECUTION]: The skill instructions in SKILL.md direct the agent to resolve and execute scripts from paths relative to the workflow.md file.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of meeting media and transcripts from Feishu servers. It also references the feishu-cli tool hosted on the author's GitHub repository (github.com/riba2534/feishu-cli).
Audit Metadata