Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Feishu Sheets integration, but it can use tenant credentials to read, write, and delete live spreadsheet data without built-in confirmation or guardrails.
Install only if you intend to let the agent manage Feishu Sheets with tenant app credentials. Use the least-privileged Feishu app scopes and restrict the app's access to the intended spreadsheets. Require explicit human confirmation and preferably a backup or preview before any delete_dimension or delete_sheet operation, especially on production or business-critical sheets.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All API calls require a tenant access token in the Authorization header:
Authorization: Bearer {tenant_access_token}
Documenting a direct DELETE endpoint for dimension ranges enables powerful destructive actions that can be abused if an agent accepts untrusted parameters or acts on ambiguous user requests. In this skill’s context, spreadsheet row/column deletion is a high-risk capability because it can destroy business data quickly and at scale.
### 7. Delete Rows/Columns
**Endpoint:** `DELETE /sheets/v2/spreadsheets/{spreadsheet_token}/dimension_range`
**Request Body:** Same as insert
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
self._token = None
def _get_token(self) -> str:
"""Get tenant access token"""
if self._token:
return self._token
The skill exposes operations that necessarily interact with external Feishu services and likely credentials/tokens, but it does not declare an explicit tool scope such as allowed tools or permissions boundaries for the agent runtime. In practice, missing scope declarations can let an agent invoke broader network or environment-backed capabilities than intended, increasing the risk of unauthorized data access or exfiltration if the skill is misused or composed with other agent behavior.
The skill documents destructive actions like deleting rows/columns and deleting worksheets without any requirement to confirm user intent, warn about irreversibility, or recommend safeguards. In an agent setting, ambiguous prompts or prompt injection could cause accidental destructive edits to production spreadsheets, leading to data loss or operational disruption.
The documentation exposes row/column and worksheet deletion capabilities without any warning about irreversible data loss, confirmation requirements, or safer alternatives. In an agent skill context, this can encourage automated destructive actions on live spreadsheets without adequate user awareness or guardrails.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if self._token:
return self._token
resp = requests.post(AUTH_API, json={
"app_id": self.app_id,
"app_secret": self.app_secret
})
This code reads sensitive credentials from environment variables and transmits them to the Feishu authentication endpoint, but there is no user-facing disclosure such as a prompt, log message, or warning comment explaining that credentials will be used for a network request. For a code file, this matches the missing-warning criterion for access to sensitive environment variables and network transmission of system data.
The delete_dimension operation irreversibly deletes rows or columns via an API call, but the CLI path provides no confirmation prompt or user-facing warning before executing it. Although the method docstring names the action, there is no visible disclosure in the execution flow warning users about the destructive effect.
The delete_sheet action removes a worksheet through the API and is irreversible from this tool's perspective, yet the CLI executes it without confirmation, warning output, or other user disclosure. This fits the missing-warning rule for destructive operations in code files.