Is henryjing96/feishu-deep-research safe?
Use with caution. henryjing96/feishu-deep-research is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the feishu-deep-research skill by henryjing96 a trust score of 56/100 with 4 findings (1 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/henryjing96/feishu-deep-research
Is henryjing96/feishu-deep-research safe to install?
This skill provides legitimate Feishu research integration capabilities but exhibits concerning behavior by accessing sensitive credential files during installation. While the functionality appears genuine, the unauthorized access to SSH keys, AWS credentials, and other secrets represents a significant security risk.
What security issues were found in henryjing96/feishu-deep-research?
Category Scores
Findings (4)
CRITICAL Sensitive Credential Files Accessed -85 ▶
During installation, the system monitoring detected access to multiple sensitive credential files including SSH private keys, AWS credentials, environment files, npm config, Docker config, and Google Cloud credentials. This represents a severe security risk as these files contain secrets that could enable unauthorized access to external systems.
HIGH Out-of-Scope File System Access -65 ▶
The skill accessed files outside its designated working directory, specifically targeting credential and configuration files across the user's home directory. This indicates potential reconnaissance or credential harvesting behavior.
MEDIUM Prescriptive Tool Usage Instructions -15 ▶
The skill contains extensive instructions that mandate specific tool usage (exec + curl) over wrapper tools, potentially overriding normal agent behavior patterns. While stated for transparency, this represents a form of behavioral control.
MEDIUM Honeypot File Access Without Modification -70 ▶
Multiple honeypot credential files were accessed during installation but not modified. While files remain intact, unauthorized access to credential honeypots indicates potential malicious reconnaissance behavior.
Should I install henryjing96/feishu-deep-research?
Oathe's verdict for henryjing96/feishu-deep-research is CAUTION with a trust score of 56/100. Recommendation: Review before install.