慧科小爱舆情数据同步

Incrementally fetch data from Huike/Xiaoai API and write to Feishu Bitable, supporting automatic partitioning for tables over 10,000 records.

Security Scan

The skill's code, runtime instructions, and required inputs align with its stated purpose (incremental fetch from Huike/Xiaoai and write to Feishu Bitable); nothing in the package suggests unrelated or hidden behavior.

Purpose & Capability

Name/description say it fetches from Huike/Xiaoai and writes to Feishu Bitable; SKILL.md inputs (app_id, app_secret, xiaoai_token, bitable_url, base URL) and the Python code implement exactly that. No unrelated credentials, binaries, or external services are requested.

Instruction Scope

Entrypoint runs sync_skill.py which reads the declared inputs and calls excel_to_feishu_bitable. The code only reads/writes a local .cache directory (tenant token and key cache) and performs HTTP calls to Feishu and the configured Huike/Xiaoai base URL. It does not read arbitrary system files or exfiltrate data to unexpected endpoints.

Install Mechanism

No install spec (instruction-only skill) beyond shipping Python source files. The package will place code on disk (normal for a code-based skill) but there are no external installers, downloads, or archive extraction steps.

Credentials

Required secrets (Feishu APP_ID/APP_SECRET, Xiaoai token) are proportional to the described integration. The skill caches the tenant_access_token and some key lists to a local .cache file — reasonable for performance but these files contain tokens/IDs and should be treated as sensitive.

Persistence & Privilege

always is false; the skill does not request permanent platform-level privileges or modify other skills. It writes cache files into its own directory but does not alter system-wide configuration.

Assessment

This skill appears to do exactly what it says: call the Huike/Xiaoai API and write records into a Feishu Bitable. Before installing, note: (1) you must provide a Feishu APP_ID/APP_SECRET and a Xiaoai token — grant these only to a dedicated app/account with minimal permissions; (2) the skill caches tokens and key lists under a .cache directory next to the code (these files contain sensitive tokens/IDs), so avoid running it on shared machines or where others can read the skill directory; (3) network calls are limited to the Feishu open API and the configured Huike base URL (default wisers-data-service...), so review the base URL if you plan to change it; (4) review the Feishu app scopes you grant (bitable read/write) to limit blast radius. If you need higher assurance, request a review of the Feishu app permissions and verify the Xiaoai token scope and rotation policy.

name: xiaoai_sync_to_bitable version: "2.0.0" description: > 从惠科/小爱数据接口增量拉取数据，写入飞书多维表。 支持单表 10000 条自动分表；不包含标注逻辑。

entrypoint: command: "python" args: - "sync_skill.py"

inputs:

• name: minutes type: integer required: false default: 60 description: 同步时间窗口，往前补偿的分钟数（基于当前时间）

• name: folder_id type: integer required: false default: 763579 description: 小爱接口 folder_id

• name: customer_id type: string required: false default: "xmxa" description: 小爱接口 customer_id

• name: app_id type: string required: true description: 飞书开放平台应用 APP_ID

• name: app_secret type: string required: true description: 飞书开放平台应用 APP_SECRET

• name: xiaoai_token type: string required: true description: 小爱/惠科接口 token（Bearer 后面的部分）

• name: bitable_url type: string required: true description: 目标飞书多维表视图链接（包含 base/app_token 和 table 参数）

• name: xiaoai_base_url type: string required: false default: "http://wisers-data-service.wisersone.com.cn" description: 惠科/小爱 API 基础域名

outputs:

• name: inserted_count type: integer description: 本次同步写入多维表的记录数

permissions: network: - "https://open.feishu.cn" - "http://wisers-data-service.wisersone.com.cn"