Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
bitable-formula-generator
v1.1.0飞书多维表格字段公式生成器。通过导出Excel分析字段结构，利用Excel公式逻辑生成多维表格兼容公式，并写入多维表格字段。
⭐ 0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description (Feishu / 多维表格 formula generator) align with the included script and SKILL.md: the skill enumerates tables/fields and can create or update formula fields via Feishu bitable APIs. This capability legitimately requires access to a Feishu app (app_id/app_secret) and an app_token parameter. The incoherence: registry metadata lists no required env vars or primary credential, but SKILL.md and the included script explicitly require FEISHU_APP_ID and FEISHU_APP_SECRET. That mismatch should be resolved before trusting the package.
Instruction Scope
The runtime instructions explicitly instruct the agent/user to fetch tenant access tokens (via FEISHU_APP_ID/FEISHU_APP_SECRET), call open.feishu.cn APIs, read Excel exports or use provided field lists, and then write formulas back to the bitable (or instruct the user to paste). All actions are within the stated purpose (discover fields and update formula fields). However, these instructions include destructive actions (create/update fields) on remote data—so users should expect the skill to modify remote resources and take backups/confirmations.
Install Mechanism
No install spec; this is instruction-only with a single clear JS utility script. There is no download-from-arbitrary-URL behavior, no obfuscated code, and the script uses Node's https module and plain JSON. This is low install risk. The presence of a code file increases the surface compared with pure prose, but the code is readable and interfaces only with open.feishu.cn.
Credentials
The skill requires FEISHU_APP_ID and FEISHU_APP_SECRET (sensitive credentials) to obtain tenant_access_token and perform API calls, but the registry metadata lists no required env vars or primary credential. Requesting app credentials is proportionate to the stated function, but failing to declare them in metadata is a notable mismatch and a transparency problem. The script also requires the user-supplied app_token (from a bitable URL) which is meaningful for access. These credentials grant the skill the ability to list and modify tables/fields, so least-privilege credentials and explicit documentation are necessary.
Persistence & Privilege
The skill is not marked always:true and does not request permanent system-wide presence. The script does not modify other skills or system settings. It obtains a transient tenant_access_token at runtime and stores it in process/global memory only; there is no code that writes credentials to disk or to other services.
What to consider before installing
Before installing or running this skill:
- Recognize the main mismatch: the SKILL.md and the included script require FEISHU_APP_ID and FEISHU_APP_SECRET (sensitive credentials) but the registry metadata does not declare them. Ask the publisher to update metadata to list required env vars.
- The skill will call open.feishu.cn and can create/update formula fields in your bitable app_token. That is expected given its purpose, but it means it can change remote data—back up important formulas/tables or test on a non-production app first.
- Provide least-privileged credentials: create a dedicated Feishu app with minimal scopes and use its FEISHU_APP_ID / FEISHU_APP_SECRET, not your organization-wide admin credentials.
- Inspect the included script yourself (scripts/feishu-bitable-api.js) — it is readable and only communicates with open.feishu.cn, but you should confirm there are no unexpected endpoints or credential exfiltration. The script obtains tenant_access_token and uses it for API calls; it does not persist tokens to disk.
- Run the script in an isolated environment (container/VM) if you are unsure, and avoid running it on machines that hold other cloud credentials.
- Consider asking the author to: (1) declare required env vars in registry metadata; (2) document required OAuth scopes/permissions; and (3) add explicit confirmation steps before modifying fields to reduce the risk of accidental overwrites.
If the author cannot justify the metadata omission or provide clearer scope/permission information, treat the package with caution and prefer manual formula generation or a vetted alternative.Like a lobster shell, security has layers — review code before you run it.
bitablevk97cgnznmezt3tbs6s6pnmaeq183sc8tfeishuvk97cgnznmezt3tbs6s6pnmaeq183sc8tformulavk97cgnznmezt3tbs6s6pnmaeq183sc8tlatestvk97cgnznmezt3tbs6s6pnmaeq183sc8t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.