feishu-doc-orchestrator
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator.py script coordinates the multi-step document creation process by executing local Python scripts (md_parser.py, doc_creator_with_permission.py, block_adder.py, verifier.py, and logger.py) using the subprocess.run method. These calls are well-defined, use the current Python interpreter, and target specific files within the skill's own directory structure.
- [EXTERNAL_DOWNLOADS]: The doc_verifier.py script leverages the Playwright browser automation framework to perform headless verification of created documents. This operation connects to the Feishu (ByteDance) platform, a well-known enterprise service, to confirm that documents are properly rendered and accessible.
- [SAFE]: The skill demonstrates secure handling of sensitive information by utilizing environment files (.env) and configuration templates. It explicitly instructs users to keep credentials out of version control and uses a .gitignore file to exclude local configuration and token storage.
- [SAFE]: The md_parser.py and doc_verifier.py scripts include defensive sanitization routines that identify and remove zero-width Unicode characters (e.g., U+200B, U+FEFF) and bidirectional control characters. This prevents data corruption and mitigates potential character-based obfuscation in the processed Markdown or retrieved page titles.
Audit Metadata