feishu-cli-platform

SUSPICIOUS. The skill’s stated purpose largely matches its capabilities and it does not show obvious malicious exfiltration, but it delegates token-bearing operations to an ambiguously named external feishu-cli binary and prefers a local build artifact. Because multiple unrelated feishu-cli publishers exist and the skill does not bind to the official larksuite/cli provenance, the main risk is supply-chain trust and credential forwarding to the wrong CLI, not confirmed malware.