Security audit
Security checks for vulnerabilities and agentic risk
The skill’s powerful Teable management features are disclosed, fit its purpose, and include controls for sensitive changes and scheduled work.
Use limited account permissions and verify the target project before changes. Check uploaded files, notification recipients, and app access settings; generated apps are open by default. Review package versions, protect saved CLI credentials, and approve scheduled behavior before activation.
The declared purpose does not include Slack integration or workspace channel discovery. The supplied code directly accesses Slack resources, with no demonstrated connection to a Teable operation, making this an undeclared capability rather than an evident supporting implementation detail.
The chunk performs an external messaging action rather than a Teable operation. Although Slack notifications could support a Teable automation, this code shows no Teable interaction or automation linkage beyond the message text. Posting to Slack is therefore an undeclared capability in the supplied chunk.
The supplied chunk accesses Slack authentication resources rather than Teable resources. Although Slack could support an automation, the chunk establishes no connection to a declared Teable workflow. The comments mention messaging and channel/user lookup, but the executable code only retrieves tokens; it does not demonstrate Slack API calls, token transmission, or misuse.
Referenced artifact was not completely inspected
- **`--base-id`**: omit by default; ask user only if a command fails. See [guides/base-id-reference.md](guides/base-id-reference.md).
Referenced artifact was not completely inspected
f/apply`, `authority enable/disable`, `authority role-*` | [authority-guide.md](guides/authority-guide.md) |
Referenced artifact was not completely inspected
**Records**: `record.value-format.md`
Referenced artifact was not completely inspected
**Automations**: `automation.trigger.md`, `automation.api.md`, `automation.send-email.md`
Referenced artifact was not completely inspected
**Integrations**: `integration.slack.md`
Referenced artifact was not completely inspected
**Reference**: `reference.url.md` (parse/build Teable resource URLs; published-app URL caveats)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /table/{tableId}/record/{recordId} // Single
DELETE /table/{tableId}/record?recordIds=recA,recB // Multiple
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /table/{tableId}/record/{recordId} // Single
DELETE /table/{tableId}/record?recordIds=recA,recB // Multiple
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## External Integrations
Use `integration list` to check connected services, `integration connect --provider slack` to start OAuth, and `integration get-token --integration-id intXXX` to get access tokens.
To use integrations in scripts:
1. `integration list` — get integration IDs
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
teable auth login --device-code
### Option 2: Personal Access Token
```bash
teable auth --token <your-personal-access-token> --endpoint https://app.teable.ai
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Options:
- `--token` — Teable Personal Access Token (PAT), also settable via `TEABLE_TOKEN` or `TEABLE_PAT` env vars
- `--endpoint` — Teable server URL (default: `https://app.teable.ai`), also settable via `TEABLE_ENDPOINT` env var
- `--force` — overwrite existing config
- `--path <dir>` — takes a **directory**, writes `<dir>/.teable/cli/config.json` (e.g. `--path .` for a project-level config)
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Options:
- `--token` — Teable Personal Access Token (PAT), also settable via `TEABLE_TOKEN` or `TEABLE_PAT` env vars
- `--endpoint` — Teable server URL (default: `https://app.teable.ai`), also settable via `TEABLE_ENDPOINT` env var
- `--force` — overwrite existing config
- `--path <dir>` — takes a **directory**, writes `<dir>/.teable/cli/config.json` (e.g. `--path .` for a project-level config)
### Auth management
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Auth config is saved to `~/.teable/cli/config.json` by default.
## Getting a Personal Access Token
1. Log in to your Teable instance (e.g. https://app.teable.ai)
2. Go to **Settings** → **Personal Access Tokens**
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Getting a Personal Access Token
1. Log in to your Teable instance (e.g. https://app.teable.ai)
2. Go to **Settings** → **Personal Access Tokens**
3. Click **Create new token**, give it a name, and copy the generated token
4. Use it with `teable auth --token teable_pat_xxx`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
`teable import-google-sheet` uses the native importer; each selected worksheet becomes a table. Import into an existing project when one is already the target, otherwise provide a space and project name to create a new project.
**Credential decision:** publicly shared spreadsheets need none. Otherwise the connected Google Sheets integration is resolved and refreshed automatically. Its `drive.file` scope can read only spreadsheets the user selected in Teable's **Import from Google Sheets** dialog; a 403/404 usually means the user must select that spreadsheet there once. Use an integration ID only to disambiguate connections, and a Google access token only as an explicit override.
**Workflow:**
Although this command installs a skill rather than referencing an MCP server, npx skills can download and execute an unpinned npm package with the invoking user's privileges. A compromised future release could execute malicious code, and the GitHub skill source is also unpinned; listing a source commit elsewhere in the README does not constrain the installation. This is a supply-chain exposure, not evidence that the current package or skill is malicious.
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Supported statistic functions include: `count`, `empty`, `filled`, `unique`, `max`, `min`, `sum`, `average`, `checked`, `unChecked`, `percentEmpty`, `percentFilled`, `percentUnique`, `percentChecked`, `percentUnChecked`, `earliestDate`, `latestDate`, `dateRangeOfDays`, `dateRangeOfMonths`, `totalAttachmentSize`.
- **Strongly recommended:** For any statistics/aggregation tasks, always use this endpoint instead of iterating records and computing aggregations manually.
## 🏗️ Fields API
This section explicitly instructs the agent to transmit the file's binary contents to the storage URL returned by Teable, rather than merely listing an available API. Although it describes the upload mechanism, it does not warn that potentially sensitive file contents will leave the user's environment and be stored remotely.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Endpoint: The tool returns webhook.url (plus webhook.token for bearer auth), and teable automation get returns the same. External services POST JSON to that URL, with the bearer in the Authorization header:
curl -X POST <webhook.url> -H 'Authorization: Bearer <webhook.token>' -H 'Content-Type: application/json' -d '{"hello":"world"}'
Output Variables:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const response = await fetch('https://slack.com/api/chat.postMessage', {
method: 'POST',
headers: {
'Authorization': `Bearer ${slackToken}`,
The example posts record names, statuses, and a record URL to the configured Slack channel. Although Slack messaging is the stated purpose, the instructions do not warn that these record details leave the source system and become visible to the channel's members.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
await fetch('https://slack.com/api/chat.postMessage', {
method: 'POST',
headers: { 'Authorization': `Bearer ${slackToken}`, 'Content-Type': 'application/json' },
body: JSON.stringify({
No suspicious patterns detected.