中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:18 hr ago Rescan
20 /100
feishu-doc-block-writer
飞书文档 Block 拆分写入技能 - 自动将长内容拆分为多个 Blocks 写入飞书文档
Documentation-only skill referencing non-existent implementation scripts - no actual malicious code present, but SKILL.md promises functionality that doesn't exist.
Skill Namefeishu-doc-block-writer
Duration35.8s
Enginepi
✓
Safe to install
This skill references scripts/block-writer.py that are not included in the package. Either add the implementation files or update SKILL.md to clarify this is a documentation-only reference skill.

Findings 2 items

Severity Finding Location
Low
Missing Implementation Files Doc Mismatch
SKILL.md references a script at scripts/block-writer.py and shows example bash commands, but no script files exist in the skill package.
python block-writer.py --title "文档标题" --content "长文本内容..."
→ Add the implementation script or remove the script references from documentation.
 SKILL.md:53
Info
Unverified Tool Usage Doc Mismatch
SKILL.md mentions using feishu_doc tool with create/append methods but skill.json doesn't declare allowed-tools mapping.
使用 create 创建空文档，使用 append 逐块追加内容
→ Add allowed-tools declaration to skill.json if this skill invokes other skills/tools.
 SKILL.md:13
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — SKILL.md mentions script paths but no files exist
Network NONE NONE — No network calls in documentation or code
Shell NONE NONE — SKILL.md shows bash examples but no scripts exist
Environment NONE NONE — No environment variable access documented
Skill Invoke NONE READ ✓ Aligned SKILL.md: mentions feishu_doc tool usage (create/append methods)
Clipboard NONE NONE — No clipboard access documented
Browser NONE NONE — Mentions auto_open_chrome config but no actual browser automation code
Database NONE NONE — No database access documented

File Tree

2 files · 7.5 KB · 368 lines
Markdown 1f · 349L JSON 1f · 19L
├─ 📋 skill.json JSON 19L · 490 B
└─ 📝 SKILL.md Markdown 349L · 7.0 KB

Security Positives

✓ No malicious code or scripts present in the package
✓ No credential harvesting or environment variable access
✓ No network calls or data exfiltration mechanisms
✓ No obfuscated code or base64-encoded payloads
✓ No suspicious file access patterns (no ~/.ssh, ~/.aws, .env access)
✓ No supply chain risks (no external dependencies)
✓ Clean JSON metadata with proper MIT license