feishu-sheets-reader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:37 AM UTC
• Version: 1.0.0

Overview

This Feishu Sheets skill appears purpose-built rather than malicious, but it can immediately change or delete spreadsheet data without clear safety controls.

Install only if you are comfortable giving the skill Feishu credentials with write and delete access. Prefer least-privilege Feishu app scopes, avoid using it for sensitive cell values through shell commands, and require human confirmation or backups before delete_sheet or delete_dimension actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu_sheets.py:163

Finding

Sensitive Spreadsheet Data Exposed Through Command-Line Arguments

Content

View full analysis

3 else None result = client.create_spreadsheet(title, folder) elif action == "get_info": token = sys.argv[2] result = client.get_spreadsheet_info(token) elif action == "read": token = sys.argv[2] sheet_id = sys.argv[3] range_str = sys.argv[4] result = client.read_values(token, sheet_id, range_str) elif action == "write": token = sys.argv[2] sheet_id = sys.argv[3] range_str = sys.argv[4] values = json.loads(sys.argv[5]) result = client.write_values(token, sheet_id, range_str, values) elif action == "append": token = sys.argv[2] sheet_id = sys.argv[3] values = json.loads(sys.argv[4]) result = client.append_values(token, sheet_id, values) elif action == "insert_dimension": token = sys.argv[2] sheet_id = sys.argv[3] dimension = sys.argv[4] start = int(sys.argv[5]) end = int(sys.argv[6]) result = client.insert_dimension(token, sheet_id, dimension, start, end) ``` ### Technical Analysis The CLI accepts spreadsheet tokens, folder tokens, worksheet identifiers, ranges, titles, and complete write or append payloads through `sys.argv`. Process arguments are not an appropriate transport for confidential data because they may be visible through process-inspection interfaces, execution telemetry, monitoring agents, diagnostic reports, command wrappers, and shell history. The ...[truncated 2599 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-reference.md (reported line 11)May include surrounding context.

Authentication

All API calls require a tenant access token in the Authorization header:

text

Authorization: Bearer {tenant_access_token}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 149)May include surrounding context.

md

### 7. Delete Rows/Columns

**Endpoint:** `DELETE /sheets/v2/spreadsheets/{spreadsheet_token}/dimension_range`

**Request Body:** Same as insert

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu_sheets.py (reported line 25)May include surrounding context.

python

self._token = None
        
    def _get_token(self) -> str:
        """Get tenant access token"""
        if self._token:
            return self._token

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill exposes powerful spreadsheet operations and references external APIs and permissions, but it does not declare an explicit tool scope such as allowed-tools or permissions in the skill manifest itself. That ambiguity can let the runtime grant broader-than-necessary capabilities, increasing the risk of unintended network access or misuse of environment-backed credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises destructive actions such as deleting rows, columns, and sheets, but provides no warning, confirmation requirement, or guardrails against irreversible changes. In an agent setting, this creates a real risk of accidental or unauthorized data loss, especially when users provide ambiguous spreadsheet identifiers or broad commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes deletion capabilities including deleting rows/columns and deleting worksheets, but it provides no warning that these actions can permanently remove user data. Under the markdown-specific missing-warning rule, descriptions of behaviors that can affect user data should include a caution about destructive impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu_sheets.py (reported line 29)May include surrounding context.

python

if self._token:
            return self._token
            
        resp = requests.post(AUTH_API, json={
            "app_id": self.app_id,
            "app_secret": self.app_secret
        })

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI exposes row/column deletion directly and performs it immediately against the remote Feishu spreadsheet API with no confirmation, dry-run mode, bounds validation, or safeguard for destructive actions. In an agent/tooling context, this increases the risk of accidental or prompt-induced data loss because a mistaken or manipulated invocation can irreversibly remove spreadsheet data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Worksheet deletion is exposed as a single-step operation with no user-facing warning or secondary confirmation before sending the delete request to Feishu. In an agent skill, this is risky because a bad prompt, parameter mix-up, or unauthorized tool use can destroy an entire worksheet and cause immediate data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.