feishu-bitable
飞书多维表格（Bitable）的创建、查询、编辑和管理工具。包含 27 种字段类型支持、高级筛选、批量操作和视图管理。 **当以下情况时使用此 Skill**： (1) 需要创建或管理飞书多维表格 App (2) 需要在多维表格中新增、查询、修改、删除记录（行数据） (3) 需要管理字段（列）、视图、数据表 (4) 用户提到"多维表格"、"bitable"、"数据表"、"记录"、"字段" (5) 需要批量导入数据或批量更新多维表格
74
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
2 findings: 2 high severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill's examples and parameter table require an "app_token" (and show it inline in JSON), which means the agent would need to include secret token values verbatim in generated requests/outputs, creating an exfiltration risk.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I scanned the documentation for high-entropy literal values that look like real access tokens. I flagged the file_token strings because they are long, random-looking tokens that would grant access to uploaded media (Drive/file tokens) and are not placeholders or truncated. I ignored many other patterns that are clearly placeholders or examples: - Ignored "S404b...", "tblXXXXXXXX", "fldXXXXXXXX", "rec..." and similar values because they are truncated/placeholders or example IDs. - Ignored user IDs like "ou_8240099442cf5da49f04f4bf8f8abcef" because these are identifiers (not credentials that grant service access). - Ignored values containing "xxxxxxxx" or "..." (redacted/truncated) as per rules. The following literal, high-entropy file_token values are present and treated as secrets because they could be used to access uploaded files.
- Repository
- nexu-io/nexu
- Commit
dadfb1c
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.