feishu-bitable
飞书多维表格（Bitable）的创建、查询、编辑和管理工具。包含 27 种字段类型支持、高级筛选、批量操作和视图管理。 **当以下情况时使用此 Skill**： (1) 需要创建或管理飞书多维表格 App (2) 需要在多维表格中新增、查询、修改、删除记录（行数据） (3) 需要管理字段（列）、视图、数据表 (4) 用户提到"多维表格"、"bitable"、"数据表"、"记录"、"字段" (5) 需要批量导入数据或批量更新多维表格
75
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
2 findings: 2 high severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill's examples and required-parameter list show app_token/app identifiers (e.g., "app_token": "S404b...") and user IDs must be placed directly into API request payloads, which would force an LLM to accept and output secret/credential values verbatim.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I scanned the documentation for high-entropy, literal values that could be usable credentials. Flagged: - Several "file_token" values (e.g., "DRiFbwaKsoZaLax4WKZbEGCccoe", "BZk3bL1Enoy4pzxaPL9bNeKqcLe", "J7GdbgNWWoD1fwx7oWccxdgknIe") are random-looking, high-entropy tokens. file_token values can grant access to uploaded files and therefore meet the definition of a secret if they are real/active. These appear as full tokens (not redacted placeholders) in examples, so I flagged them. Ignored: - Truncated/redacted placeholders like "S404b...", "tbl...", "fldXXXXXXXX" (contain "..." or clearly placeholders) — treated as documentation placeholders. - open_id/user IDs like "ou_8240099442cf5da49f04f4bf8f8abcef" — these are identifiers (user IDs), not credentials that provide service access, so I did not flag them. - Phone numbers and example emails — not secrets per the given definition. If these file_token values are intended to be example/fake values, they should be replaced with explicit placeholders (e.g., "YOUR_FILE_TOKEN") or removed. If they are real, they should be revoked and rotated.
- Repository
- op7418/CodePilot
- Commit
215c8f9
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.