feishu-cli-meetings

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL points to a third‑party GitHub repository (an individual account) used as the installation source for a CLI tool rather than an official vendor/package-manager distribution, which can be used to distribute executables and therefore poses a potential security risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该工作流通过飞书开放 API 执行 vc search / vc notes / vc recording / minutes get/search/download 等读取飞书会议记录与妙记逐字稿；这些文本在运行时来自飞书用户/会议内容（外部非该技能作者提交的免费文本），会被 LLM/脚本用于输出或导出。