Feishu Sheets Skill

Feishu online spreadsheet (Sheets) operations including create, read, write, append data, manage worksheets. Use when user mentions Feishu Sheets, online spr...

Security Scan

The skill appears to implement Feishu Sheets operations correctly, but there are important mismatches between what the registry declares and what the code actually requires (sensitive Feishu app credentials and an undeclared dependency), so proceed with caution.

Purpose & Capability

The name/description (Feishu Sheets operations) matches the code's behavior (create/read/write/append sheets via Feishu APIs). However the package metadata declares no required environment variables or primary credential while the included script clearly expects FEISHU_APP_ID and FEISHU_APP_SECRET environment variables for authentication. That omission is a material mismatch.

Instruction Scope

SKILL.md documents spreadsheet actions and how to extract spreadsheet tokens from URLs, but it does not state how to obtain or supply the tenant access token nor mentions the need to set FEISHU_APP_ID/FEISHU_APP_SECRET. The runtime instructions therefore omit a necessary authentication step (the Python client calls the Feishu auth API using app_id/app_secret), which is scope/information missing from the manifest and instructions.

Install Mechanism

There is no install spec (instruction-only) which is low-risk in principle, but the included Python script requires the 'requests' library and a Python runtime. The registry does not declare these dependencies or required binaries. This mismatch can lead to runtime failures and hides the fact that code will run outbound HTTPS requests. No external or unusual download URLs are present.

Credentials

The script requires sensitive credentials (FEISHU_APP_ID and FEISHU_APP_SECRET) to obtain a tenant_access_token, but the registry metadata lists no required environment variables or primary credential. Requesting app_id/app_secret is reasonable for a Feishu Sheets client, but the lack of declaration is a red flag: you should not supply organization-wide or high-privilege secrets without understanding scope and owner. The requested credentials are proportionate to the feature set, but they must be explicitly declared and limited.

Persistence & Privilege

The skill is not marked always:true, does not claim to persist beyond its own operation, and does not modify other skills or system settings. It runs as a CLI-like client and uses network calls only to Feishu open-apis endpoints.

What to consider before installing

Before installing or enabling this skill: (1) Understand it will need FEISHU_APP_ID and FEISHU_APP_SECRET (sensitive credentials) even though the registry doesn't declare them—only provide credentials if you trust the skill owner and limit the app's permissions. (2) Review the included scripts/feishu_sheets.py yourself (or have someone you trust review it) since the runtime behavior is implemented in that file. (3) Ensure the environment has Python and the 'requests' library, or run in an isolated sandbox. (4) Prefer creating a minimal-scope Feishu app (least privilege) and rotate/revoke credentials after use. (5) If you are in an organization, consult your security/admin team before providing app credentials or running this skill.

Feishu Sheets Tool

Single tool feishu_sheets with action parameter for all spreadsheet operations.

Token Extraction

From URL https://xxx.feishu.cn/sheets/shtABC123 → spreadsheet_token = shtABC123

Actions

Create Spreadsheet

{ "action": "create", "title": "New Spreadsheet" }

Optional folder:

{ "action": "create", "title": "New Spreadsheet", "folder_token": "fldcnXXX" }

Returns: spreadsheet_token, url, title

Write Values

{
  "action": "write",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx",
  "range": "A1:C3",
  "values": [["Name", "Age", "City"], ["Alice", 25, "Beijing"], ["Bob", 30, "Shanghai"]]
}

Read Values

{
  "action": "read",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx",
  "range": "A1:C10"
}

Append Values

{
  "action": "append",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx",
  "values": [["Charlie", 28, "Shenzhen"]]
}

Insert Rows/Columns

{
  "action": "insert_dimension",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx",
  "dimension": "ROWS",
  "start_index": 5,
  "end_index": 7
}

Delete Rows/Columns

{
  "action": "delete_dimension",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx",
  "dimension": "ROWS",
  "start_index": 5,
  "end_index": 7
}

Get Spreadsheet Info

{ "action": "get_info", "spreadsheet_token": "shtABC123" }

Returns: metadata including all sheet_ids and titles

Add Worksheet

{
  "action": "add_sheet",
  "spreadsheet_token": "shtABC123",
  "title": "Sheet2"
}

Delete Worksheet

{
  "action": "delete_sheet",
  "spreadsheet_token": "shtABC123",
  "sheet_id": "0bxxxx"
}

Range Format

• Cell: A1, B5
• Range: A1:C10, B2:D5
• Entire column: A:A, B:D
• Entire row: 1:1, 3:5
• With sheet_id: 0bxxxx!A1:C10

Sheet ID

• From URL: https://xxx.feishu.cn/sheets/shtABC123?sheet=0bxxxx
• From get_info action
• Default first sheet often has simple id like 0bxxxx

Data Types

Values can be:

• String: "Hello"
• Number: 123, 45.67
• Formula: {"type": "formula", "text": "=SUM(A1:A10)"}
• Link: {"type": "url", "text": "Click here", "link": "https://..."}

Configuration

channels:
  feishu:
    tools:
      sheets: true  # default: true

Permissions Required

• sheets:spreadsheet - Create and manage spreadsheets
• sheets:spreadsheet:readonly - Read spreadsheet data
• drive:drive - Access cloud storage

API Reference

Base URL: https://open.feishu.cn/open-apis/sheets/v2/spreadsheets/

See references/api-reference.md for detailed API documentation.