feishu-board

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's commands explicitly take doc IDs and board tokens as command-line arguments (e.g., python ... read <board_token>), which encourages embedding sensitive tokens/keys verbatim into generated commands or code, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's cmd_read (scripts/board_ctl.py) explicitly fetches and paginates board nodes from Feishu via the Board API (GET /open-apis/board/v1/whiteboards/{token}/nodes), ingesting user-generated board content which the tool parses and uses to reconstruct flows and inform actions, so untrusted third‑party content could indirectly inject instructions.