Feishu Manager

Comprehensive Feishu (飞书) management toolkit for documents, knowledge bases, bitables, and cloud storage.

Security Scan

The skill claims to manage Feishu but fails to declare or request the Feishu credentials/config it clearly needs, and it asks for broad Feishu scopes — this mismatch is concerning and deserves caution.

Purpose & Capability

The name/description match a Feishu management tool, and the SKILL.md shows actions for documents, wiki, bitable, and drive. However the registry metadata lists no required credentials or config, while README and examples refer to app_id/app_secret, doc/app tokens, and Feishu scopes. A Feishu integration legitimately needs credentials; not declaring them is an incoherence.

Instruction Scope

The SKILL.md instructions are narrowly focused on Feishu operations (feishu_doc, feishu_wiki, feishu_bitable_*, feishu_drive) and do not instruct the agent to read arbitrary local files or external endpoints. However they rely on tokens/identifiers (doc_token, app_token, folder_token) without explaining how/where these are supplied or stored, which gives the skill implicit access to potentially sensitive workspace data if credentials are provided.

Install Mechanism

This is an instruction-only skill with no install spec and no code files beyond docs, so it does not install third-party binaries or download archives. That lowers the attack surface but also means there is no executable code to audit beyond the instructions.

Credentials

No required environment variables, primary credential, or config paths are declared in registry metadata, yet README explicitly shows channel configuration (app_id/app_secret) and SKILL.md examples require tokens. The requested Feishu scopes (docx:document, wiki:wiki, drive:drive, bitable:data) are broad; failing to declare credential requirements is disproportionate and prevents proper review of what secrets the skill will use or need.

Persistence & Privilege

always:false (normal) and autonomous invocation is allowed (platform default). This is not itself a fault, but combined with the undeclared credential requirements and broad scopes it means the agent could access Feishu data autonomously once credentials are provided — consider the blast radius in that scenario.

What to consider before installing

This skill appears to be a Feishu connector but doesn't declare the credentials or config it needs. Before installing: 1) Verify the skill's source and trustworthiness (no homepage or publisher info provided). 2) Do not supply your production app_id/app_secret or workspace tokens until you confirm provenance; test in a sandbox Feishu app/workspace. 3) Ask the author to declare required env vars/config in the registry (where credentials will be stored) and to justify each requested scope; prefer least-privilege scopes. 4) Confirm where tokens will be stored by the agent and whether the skill will act autonomously with those tokens. 5) If you must use it, create a dedicated Feishu app with minimal permissions and rotate credentials after testing.

Feishu Manager Skill

Complete toolkit for managing Feishu workspace.

Tools Used

• feishu_doc - Document operations
• feishu_wiki - Knowledge base operations
• feishu_bitable_* - Table operations
• feishu_drive - Cloud storage operations

Quick Reference

Documents

• Read: feishu_doc { "action": "read", "doc_token": "ABC123" }
• Create: feishu_doc { "action": "create", "title": "New Doc" }
• Write: feishu_doc { "action": "write", "doc_token": "ABC123", "content": "# Title" }

Wiki

• List spaces: feishu_wiki { "action": "spaces" }
• Create page: feishu_wiki { "action": "create", "space_id": "...", "title": "Page" }

Bitable

• Create table: feishu_bitable_create_app { "name": "Project" }
• List records: feishu_bitable_list_records { "app_token": "...", "table_id": "..." }

Drive

• List folder: feishu_drive { "action": "list", "folder_token": "..." }
• Create folder: feishu_drive { "action": "create_folder", "name": "New" }

Permissions Required

• docx:document
• wiki:wiki
• drive:drive
• bitable:data