Feishu Bitable API

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

This Feishu Bitable skill appears purpose-built, but it can directly change or delete live business table data without confirmation or strong safety guidance.

Install only if you are comfortable giving the skill Feishu app credentials that can read and modify Bitable data. Use a least-privilege Feishu app, test on non-production tables first, back up important data, and manually verify app-token, table-id, record-id, and @file inputs before running update or delete commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill metadata declares required environment variables but does not declare corresponding permissions, creating a mismatch between documented capabilities and the permission model. In an agent ecosystem, undeclared access to secrets increases the risk of unreviewed credential use and weakens least-privilege and auditability controls.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README documents destructive operations such as create, update, batch-create, and delete against a live Feishu Bitable instance, but it does not clearly warn that these commands directly modify remote user data. In an agent-skill context, this omission increases the chance of accidental execution by users or automation, leading to unintended data alteration or deletion in production tables.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation prominently exposes destructive table and record mutation operations, including delete and batch delete, without requiring confirmation, backup guidance, or warning about irreversible data loss. In an agent-driven workflow, this increases the chance of accidental or prompt-induced destructive actions against production data.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The skill instructs users to place application secrets in environment variables or secret files without warning about leakage through shell history, process inspection, logs, or misconfigured files. While common operational guidance, omitting secret-handling precautions can lead to credential exposure in real deployments.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The description prominently advertises destructive operations such as deleting tables and records, but does not warn users about irreversible data loss or recommend confirmation/backup practices. In an automation skill, this omission increases the chance of accidental destructive use, especially when integrated into broader workflows or batch operations.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The setup instructions tell users to place Feishu application credentials into a .env file but provide no security guidance about protecting those secrets. This can lead to accidental exposure through source control, logs, screenshots, or insecure file handling, which is especially relevant for API skills that operate with potentially broad data access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"url": "https://github.com/clawdbot/skills/issues"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.0"
  },

• Confidence: 89% confidence
• Finding: "axios": "^1.6.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.0"
  },
  "engines": {

• Confidence: 84% confidence
• Finding: "commander": "^11.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "axios": "^1.6.0",
    "commander": "^11.1.0",
    "dotenv": "^16.3.0"
  },
  "engines": {
    "node": ">=16.0.0"

• Confidence: 83% confidence
• Finding: "dotenv": "^16.3.0"

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: axios==1.6.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/utils.js:13

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/api.js:13