Security audit
Security checks for vulnerabilities and agentic risk
This Feishu Sheets skill mostly matches its spreadsheet purpose, but it can directly delete or alter remote spreadsheets and includes under-described management capabilities without clear safeguards.
Install only if you intend to let an agent read and modify Feishu Sheets. Treat delete rows, delete columns, delete worksheet, find/replace, and protection changes as high-impact actions: use test spreadsheets first, keep backups or version history, limit Feishu app permissions, and require explicit human confirmation before destructive operations.
The documented purpose understates or omits materially different capabilities such as permission/protection changes, comments, formatting, and worksheet copying. This mismatch is dangerous because users and policy layers may authorize the skill expecting simple spreadsheet CRUD, while the implementation could alter protections, expose more data, or perform broader modifications than anticipated.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
self.access_token = None
def get_access_token(self):
"""获取Access Token"""
url = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal"
data = {
"app_id": self.app_id,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All API calls require a tenant access token in the Authorization header:
Authorization: Bearer {tenant_access_token}
The documented delete endpoint enables direct destructive modification of spreadsheet structure, and the reference provides no approval, validation, or safety constraints around its use. In an agent-integrated skill, parameter abuse or prompt misunderstanding could translate into unauthorized or overbroad deletion of rows or columns, making this more dangerous than ordinary static documentation.
### 7. Delete Rows/Columns
**Endpoint:** `DELETE /sheets/v2/spreadsheets/{spreadsheet_token}/dimension_range`
**Request Body:** Same as insert
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
self._token = None
def _get_token(self) -> str:
"""Get tenant access token"""
if self._token:
return self._token
The README documents create, write, append, and delete-capable spreadsheet operations without any warning that these actions modify remote Feishu data and may be irreversible. In an agent skill context, this increases the chance that an agent or user invokes destructive actions on production spreadsheets without explicit confirmation or safeguards.
The documentation exposes delete-sheet functionality without warning that removing a sheet can permanently delete data or break dependent workflows. Because this skill is intended for agent use, omitting such warnings makes accidental destructive execution more plausible than in a passive library README.
The column deletion example demonstrates a destructive structural change without warning about loss of cell contents, formula breakage, and downstream reporting impact. In spreadsheet automation, deleting the wrong columns can silently corrupt datasets at scale, making this omission security-relevant from an operational integrity standpoint.
The skill does not explicitly constrain tool scope even though the content indicates capabilities that may require network and environment access. In an agent setting, missing scope declarations can enable broader-than-expected execution privileges, making it harder to enforce least privilege and increasing the chance of unintended data access or outbound requests.
The skill documents destructive operations like deleting rows, columns, and worksheets without any warning, confirmation expectation, or backup guidance. In an agent workflow, that increases the likelihood of irreversible user-data loss from ambiguous prompts, mistaken identifiers, or automation errors.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"app_id": self.app_id,
"app_secret": self.app_secret
}
resp = requests.post(url, json=data)
if resp.status_code == 200:
self.access_token = resp.json().get("tenant_access_token")
return self.access_token
The skill exposes sheet deletion as a direct API call with no built-in confirmation, dry-run mode, or guardrail against accidental invocation. In an agent context, ambiguous prompts, prompt injection, or misrouting could cause irreversible destruction of user data without clear user awareness.
Deleting rows or columns is a destructive modification, yet the method performs the operation immediately without confirmation or safeguards. In a tool used by an autonomous or semi-autonomous agent, this increases the risk of accidental data loss from prompt confusion or malicious instruction chaining.
The manifest describes the skill as supporting create/read/write data, appending rows, inserting/deleting rows or columns, and managing worksheets. The code additionally changes visual styles, applies sheet protection permissions, creates conditional formatting rules, and reads/adds comments, which are materially different capabilities not reflected in the declared description or supported operations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
url = f"https://open.feishu.cn/open-apis/sheets/v3/spreadsheet/{spreadsheet_token}/sheets/{sheet_id}/style"
headers = {"Authorization": f"Bearer {self.access_token}"}
data = {"range": range, "style": style}
resp = requests.put(url, json=data, headers=headers)
return resp.json()
def protect_sheet(self, spreadsheet_token, sheet_id, permission):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
url = f"https://open.feishu.cn/open-apis/sheets/v3/spreadsheet/{spreadsheet_token}/sheets/{sheet_id}/style"
headers = {"Authorization": f"Bearer {self.access_token}"}
data = {"range": range, "style": style}
resp = requests.put(url, json=data, headers=headers)
return resp.json()
def protect_sheet(self, spreadsheet_token, sheet_id, permission):
The module docstring and user-facing descriptions are only in Chinese, which effectively forces a specific language for users of the skill. The policy allows language constraints only when the skill offers user choice or clearly documents a justified locale restriction, neither of which appears here.
The reference documents destructive operations such as deleting rows, columns, and worksheets without any warning, confirmation guidance, or guardrails around irreversible data loss. In an agent skill context, this increases the chance that an automated workflow could execute destructive actions from ambiguous or mistaken user prompts, causing loss or corruption of spreadsheet data.
No suspicious patterns detected.