Trust Assessment
feishu-calendar received a trust score of 80/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 3 findings: 0 critical, 0 high, 3 medium, and 0 low severity. Key findings include Missing required field: name, Unpinned npm dependency version, Potential Data Exfiltration via Public Status File.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Missing required field: name The 'name' field is required for claude_code skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/autogame-17/feishu-calendar/SKILL.md:1 | |
| MEDIUM | Unpinned npm dependency version Dependency '@larksuiteoapi/node-sdk' is not pinned to an exact version ('^1.0.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/autogame-17/feishu-calendar/package.json | |
| MEDIUM | Potential Data Exfiltration via Public Status File The `sync.js` script reads calendar event summaries and writes them to `../../HEARTBEAT.md`. If calendar events contain sensitive or personally identifiable information (PII) from user input, this data could be exfiltrated if `HEARTBEAT.md` is publicly accessible or frequently exposed in agent responses. The script does not sanitize or filter the content of event summaries before writing them to this status file. Implement content filtering or sanitization for event summaries before writing them to `HEARTBEAT.md`. Ensure that `HEARTBEAT.md` is not exposed publicly if it contains sensitive information. Consider redacting or masking sensitive parts of event summaries, especially if they originate from untrusted user input. | LLM | sync.js:90 |
Scan History
Embed Code
[](https://skillshield.io/report/ac51cb199bd5d573)
Powered by SkillShield