Feishu Sheets (Fixed)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:21 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Feishu Sheets integration, but it can use tenant credentials to read, write, and delete live spreadsheet data without built-in confirmation or guardrails.

Install only if you intend to let the agent manage Feishu Sheets with tenant app credentials. Use the least-privileged Feishu app scopes and restrict the app's access to the intended spreadsheets. Require explicit human confirmation and preferably a backup or preview before any delete_dimension or delete_sheet operation, especially on production or business-critical sheets.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

## Authentication

All API calls require a tenant access token in the Authorization header:
```
Authorization: Bearer {tenant_access_token}
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 7. Delete Rows/Columns

**Endpoint:** `DELETE /sheets/v2/spreadsheets/{spreadsheet_token}/dimension_range`

**Request Body:** Same as insert

• Confidence: 90% confidence
• Finding: Documenting a direct DELETE endpoint for dimension ranges enables powerful destructive actions that can be abused if an agent accepts untrusted parameters or acts on ambiguous user requests. In this skill’s context, spreadsheet row/column deletion is a high-risk capability because it can destroy business data quickly and at scale.

Credential Access

High

• Category: Privilege Escalation

Content

self._token = None
        
    def _get_token(self) -> str:
        """Get tenant access token"""
        if self._token:
            return self._token

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes operations that necessarily interact with external Feishu services and likely credentials/tokens, but it does not declare an explicit tool scope such as allowed tools or permissions boundaries for the agent runtime. In practice, missing scope declarations can let an agent invoke broader network or environment-backed capabilities than intended, increasing the risk of unauthorized data access or exfiltration if the skill is misused or composed with other agent behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents destructive actions like deleting rows/columns and deleting worksheets without any requirement to confirm user intent, warn about irreversibility, or recommend safeguards. In an agent setting, ambiguous prompts or prompt injection could cause accidental destructive edits to production spreadsheets, leading to data loss or operational disruption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes row/column and worksheet deletion capabilities without any warning about irreversible data loss, confirmation requirements, or safer alternatives. In an agent skill context, this can encourage automated destructive actions on live spreadsheets without adequate user awareness or guardrails.

External Transmission

Medium

• Category: Data Exfiltration

Content

if self._token:
            return self._token
            
        resp = requests.post(AUTH_API, json={
            "app_id": self.app_id,
            "app_secret": self.app_secret
        })

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code reads sensitive credentials from environment variables and transmits them to the Feishu authentication endpoint, but there is no user-facing disclosure such as a prompt, log message, or warning comment explaining that credentials will be used for a network request. For a code file, this matches the missing-warning criterion for access to sensitive environment variables and network transmission of system data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The delete_dimension operation irreversibly deletes rows or columns via an API call, but the CLI path provides no confirmation prompt or user-facing warning before executing it. Although the method docstring names the action, there is no visible disclosure in the execution flow warning users about the destructive effect.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The delete_sheet action removes a worksheet through the API and is irreversible from this tool's perspective, yet the CLI executes it without confirmation, warning output, or other user disclosure. This fits the missing-warning rule for destructive operations in code files.

Static analysis

No suspicious patterns detected.