feishu-sheets-reader

• Outcome: Review
• Latest audit: May 29, 2026 at 9:26 PM UTC
• Version:
  1.0.0

Overview

This is a real Feishu Sheets integration, but it can use app credentials to modify or delete cloud spreadsheet data without documented confirmation or tight scope controls.

Review before installing. Use a least-privilege Feishu app, avoid broad Drive or production spreadsheet access until tested, and require the agent to confirm the exact spreadsheet token, sheet ID, and affected range before any write or delete operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents destructive actions such as deleting rows/columns and deleting worksheets, but provides no guidance to require explicit user confirmation, summarize the affected range, or warn about irreversible changes. In an agent setting, this increases the risk of accidental data loss from ambiguous prompts, misunderstanding of indices, or misuse of the tool on the wrong spreadsheet or sheet.

VirusTotal

63/63 vendors flagged this skill as clean.