feishu-wiki

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能的运行流程通过 scripts/list_wiki.py 与 scripts/read_bitable.py 直接读取飞书知识库目录/多维表格记录中的文本内容（例如 get_table_records() 与后续 format_field_value() 对记录字段值进行读取与格式化），而这些文本可包含由外部/用户侧作者写入的内容，且调用方可通过 URL/参数触发读取指定条目。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I looked for high-entropy literal values that could act as usable credentials.

Flagged:

• BITABLE_APP_TOKEN (scripts/add_records.py) is a high-entropy token-like string (BUkFb4Izna2q0Ys2BOXc8i6Hnsf) used as an app token in API calls — this appears to be an actual credential-like value and is flagged.

Ignored:

• APP_SECRET values are set to "REMOVED_FEISHU_SECRET" — this is an explicit redaction/placeholder, so ignored.
• APP_ID values (e.g., "cli_a9f6d47ef9fa5cd5") are application identifiers (not secrets) and are common to keep in code/config.
• Node tokens, table IDs and space IDs shown in SKILL.md and scripts (e.g., YylJw806IinEJmkwOWVcv8HInph, tbl8sCnDARGYuu8W, 7591325128043121630) are resource identifiers/IDs. They look random but are likely non-credential identifiers (used to reference resources) and do not meet the definition of a secret here, so I did not flag them.
• No private key / PEM blocks or clear high-entropy API secret strings (other than the BITABLE_APP_TOKEN) were present.

Therefore I mark one real secret present (the BITABLE app token).