Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Lark Sheets Skill Security Audit

What the author says it does (original text)

飞书电子表格：创建和操作电子表格。支持创建表格、管理工作表与行列结构（增删/合并/调整尺寸/隐藏/冻结）、读写单元格（值/公式/样式/批注/单元格图片）、查找替换、多操作批量更新，以及图表、透视表、条件格式、筛选器、迷你图、浮动图片等对象的创建与维护。当用户需要创建电子表格、管理工作表、批量读写或编辑数据、统计汇总与可视化、表格美化、公式计算（含 Excel 公式迁移）、金融/财务建模（DCF、三张表、预算、Sensitivity 等）等任务时使用。若用户是想按名称或关键词搜索云空间（云盘/云存储）里的表格文件，请改用 lark-drive 的 drive +search 先定位资源。当用户给出 doubao.com 的 /sheets/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域

Independent security check

Do not install or run it yet

This check is incomplete. Only available results are shown below.

Files checked
29
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
High risk

Whole-workbook revert is labeled high risk but lacks the documented user-confirmation gate

Source references: 7
What we found

A revert overwrites the current workbook with a historical version and is explicitly labeled high-risk. However, its system flags list only `--dry-run`, its execution example does not require `--yes`, and it is absent from the main strong-confirmation list.

Why this matters

If an agent invokes the example without renewed explicit consent, cells, formulas, objects, and collaborators' recent changes after that version may be overwritten across the workbook.

The documentation says revert overwrites the entire workbook and is high-risk, yet its declared flags and execution example have no `--yes` gate, and the main confirmation list omits it. It says to explain the impact but does not explicitly require consent. An agent could therefore start an asynchronous revert without clear approval. Users can ask that revert use the same dry-run, explicit-consent, and `--yes` protocol.

references/lark-sheets-history.md:5In the instructionsOpen original file
每张飞书电子表格保留一串历史版本（`minor_histories`）。每个版本由 `history_version_id` 标识，并附带创建时间（`create_time`）、动作（`action`）与块修订信息（`all_block_revision`）。历史是**工作簿级**的（针对整张电子表格，不针对单个子表）。回滚（revert）把电子表格的当前内容覆盖回某个历史版本——这是一个**高风险写入**操作，且为**异步**：发起后立即返回受理标识，真正的回滚在后台进行，需通过状态查询轮询最终结果（进行中 / 成功 / 失败）。
Show 6 other places
references/lark-sheets-history.md:34In the instructionsOpen original file
| --- | --- | --- || `+history-list` | read | 历史版本 || `+history-revert` | high-risk-write | 历史版本 || `+history-revert-status` | read | 历史版本 |
references/lark-sheets-history.md:48In the instructionsOpen original file
### `+history-revert`_公共：URL/token（无 sheet 定位） · 系统：`--dry-run`_| Flag | Type | 必填 | 说明 || --- | --- | --- | --- || `--history-version-id` | string | required | 要回滚到的历史版本（取自 +history-list） |
references/lark-sheets-history.md:81In the instructionsOpen original file
### `+history-revert````bash# 回滚到指定历史版本（异步受理）lark-cli sheets +history-revert --url "https://sample.feishu.cn/sheets/SHTxxxxxx" --history-version-id "<id-from-history-list>"```
references/lark-sheets-history.md:7In the instructionsOpen original file
回滚（revert）把电子表格的当前内容覆盖回某个历史版本——这是一个**高风险写入**操作，且为**异步**：发起后立即返回受理标识，真正的回滚在后台进行，需通过状态查询轮询最终结果（进行中 / 成功 / 失败）。
references/lark-sheets-history.md:24In the instructionsOpen original file
**注意事项（必须了解）**：- **回滚是高风险写入操作**：会用历史版本内容覆盖当前表格，执行前应明确告知用户影响。- **回滚是异步的**：`+history-revert` 返回的是 `transaction_id`（受理标识），不代表回滚已完成；必须用 `+history-revert-status --transaction-id <transaction_id>` 确认最终结果。- **`history_version_id` 与 `transaction_id` 不是同一个**：`history_version_id` 用于 `+history-revert`（取自 `+history-list`）；`transaction_id` 用于 `+history-revert-status`（取自 `+history-revert` 的输出）。
SKILL.md:220In the instructionsOpen original file
> ⚠️ **high-risk-write 命令清单（exit 10 强确认门禁）**：`+batch-update`、`+cells-clear`、`+cells-batch-clear`、`+sheet-delete`、`+dim-delete`、`+dropdown-delete`，以及各对象删除 `+chart-delete` / `+pivot-delete` / `+cond-format-delete` / `+filter-delete` / `+filter-view-delete` / `+sparkline-delete` / `+float-image-delete`。>> **审批协议**：先 `--dry-run` 预览、向用户展示将执行的操作与影响范围，**获得用户明确同意后**再在原命令追加 `--yes` 执行。未经用户同意不得带 `--yes`，也不得在 exit 10 后静默补 `--yes` 重试——那等于禁用门禁。完整协议见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。
Medium risk

Cell and CSV writes allow overwrite by default, so a wrong destination can silently damage existing data

Source references: 3
What we found

Overwrite protection is off by default for `+cells-set` and `+csv-put`: `allow-overwrite` defaults to true. A CSV range specifies only the top-left anchor and does not bound the write; content expands to its own dimensions. The floating-image update workflow also suggests uploading through an “arbitrary temporary cell” and clearing it without making an emptiness check mandatory at that step.

Why this matters

A mistaken anchor, payload dimension, or temporary cell can replace existing values, formulas, notes, or images; clearing the temporary cell can then remove the original content.

These are legitimate spreadsheet-writing features, but default overwrite increases the impact of a targeting mistake: `cells-set` overwrites nonempty cells by default, while a CSV range only anchors the upper-left corner and data expands to its actual size. The docs offer dry-run, read-back, and `allow-overwrite=false` mitigations. Image replacement may also occupy a temporary cell. Users can require validation of the full destination, overwrite protection, and approval of the temporary cell.

references/lark-sheets-write-cells.md:127In the instructionsOpen original file
- 不要把 `cells` 写成字符串化 JSON- `+cells-set` 默认即覆盖非空 cell（`--allow-overwrite` 默认 true）；若要**保护**非空 cell 不被覆盖，显式传 `--allow-overwrite=false`（遇非空 cell 报错）- 若目标区域涉及合并单元格，不要向合并区域中的非左上角单元格写入数据；如需写入，应改写合并区域左上角单元格，或先调整/取消合并区域- **构造 `range` 时行号建议基于逻辑行号**：如果之前通过 `+csv-get` 读取了数据，CSV 中被双引号包裹的多行字段（如 `"2026年3月2日\n星期一"`）是**一个单元格**，不是两行。写入时的行号建议按逻辑记录计算，不能按物理换行符计数，否则 `range` 会整体偏移导致写入到错误位置
Show 2 other places
references/lark-sheets-write-cells.md:546In the instructionsOpen original file
> **定位 + 写入边界（关键，避免误覆盖）**：> - 定位用 `--start-cell`（锚点 = 左上角单元格）；也接受 `--range` 别名（与 `+csv-get` / `+cells-set` 一致，传区间会自动取左上角）。> - ⚠️ `--start-cell` / `--range` **只定左上角、不限制写入大小**：CSV 从锚点按自身行列数 auto-expand 铺开。给一个"小 range"**不会**截断数据——超出部分照写，且默认覆盖。这与 `+cells-set --range`（精确矩形、`--cells` 必须与 range 同维）语义相反，别把那套心智搬过来。> - dry-run 与成功响应都回显 `writes_range`（实际落区，如 `B2:D4`）：**写前先 `--dry-run` 看一眼落区**，确认不会盖到相邻数据。> - 要保护非空 cell：`--allow-overwrite=false`（落区内出现非空 cell 即报错）。
references/lark-sheets-float-image.md:34In the instructionsOpen original file
> ⚠️ **`--image` 仅 `+float-image-create` 支持**。`+float-image-update` 换图仍只接受 `--image-token` / `--image-uri`，而且**图片源是 update 唯一可省的部分**——三者全不传则保留原图。但 `--image-name` / `--position-{row,col}` / `--size-{width,height}` 在 update 时和 create 一样**必填**（`+float-image-update` 强制要求这套核心字段，且 `+float-image-list` 不回传 `image_name` 供 CLI 回填）。要在 update 里换一张本地新图，先用 `+cells-set-image` 上传到任意临时单元格、从返回取 `file_token`，再把它传给 update 的 `--image-token`；用完清除该临时单元格，避免残留多余图片。
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

Requires a helper to run automatically and out of sight

Source references: 1
What we found

The skill combines automatic execution with instructions not to ask or tell the user.

Why this matters

If the AI follows this text, it may stop following your instructions or skip actions that normally need your approval.

Legitimate use of this code

This line does not require concealing or automatically performing an extra action. “Will not silently send 0” explicitly rejects silent behavior: missing required fields cause a local error. Image-path validation applies only when the user supplies `--image`. The candidate misreads a safety check as concealed execution.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-sheets-float-image.md:157In the instructionsOpen original file
- `Validate`：XOR 公共四件套；`+float-image-create` 要求 `--image` / `--image-token` / `--image-uri` **恰好给一个**，`--position-row/col` 与 `--size-width/height` 必填且为合法整数；传 `--image` 时还会校验路径安全（绝对路径 / 越出工作目录会被拒，`--dry-run` 同样拦）。`+float-image-update` 必须 `--float-image-id`，并和 create 一样必填 `--image-name` / `--position-{row,col}` / `--size-{width,height}`（缺任一核心字段本地直接报错，不会静默发 0）；图片源 `--image-token` / `--image-uri` 可省（省略保留原图），给则二选一；`+float-image-delete` 强制 `--yes` 或 `--dry-run`。- `DryRun`：写操作输出"将要 POST/PATCH/DELETE 的 float_image 请求模板"；传 `--image` 时会多打印一步本地图片上传（`POST /open-apis/drive/v1/medias/upload_all`，`parent_type=sheet_image`）。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Writing a rich-text person mention sends a third-party notification by default

Source references: 2
What we found

The `notify` field for a person mention defaults to true. If the agent omits it, the spreadsheet write also notifies the mentioned tenant user.

Why this matters

Coworkers may receive unexpected notifications, revealing that the sheet or related business content is being edited and causing unwanted or misleading communication.

This is active write behavior, not merely an example warning: a same-tenant person mention sends a notification when `notify` is omitted. If the user only intended a spreadsheet edit, this additionally contacts a third party and may reveal the activity. Users can require `notify:false` for every mention unless notification is explicitly authorized.

references/lark-sheets-write-cells.md:173In the instructionsOpen original file
## 富文本单元格：超链接 / @人 / @文档（`rich_text`）带显示文本的超链接、@人、@文档这类富内容**建议**走 `+cells-set` 的 `rich_text` 字段（`cells[].rich_text` 数组，每段一个对象、带 `type`），**不能**直接传普通字符串——纯字符串只会被当作纯文本存进单元格。完整字段跑 `lark-cli sheets +cells-set --print-schema --flag-name cells`，常用段类型：- **超链接（带显示文本）**：`{"type":"link","text":"飞书","link":"https://www.feishu.cn"}`。纯 URL 不需要 `rich_text`，直接写普通字符串即可。- **@人**：`{"type":"mention","mention_token":"<userId>","notify":false}`。**仅支持同租户用户，单次写入最多 50 人。** `notify` **默认 `true`**（会给被 @ 的人发通知），不想发务必显式传 `false`。- **@文档**：同样 `"type":"mention"`，`mention_token` 传文档 token（如 `shtXXX`）。
Show 1 other places
references/lark-sheets-write-cells.md:175In the instructionsOpen original file
带显示文本的超链接、@人、@文档这类富内容**建议**走 `+cells-set` 的 `rich_text` 字段（`cells[].rich_text` 数组，每段一个对象、带 `type`），**不能**直接传普通字符串——纯字符串只会被当作纯文本存进单元格。完整字段跑 `lark-cli sheets +cells-set --print-schema --flag-name cells`，常用段类型：- **超链接（带显示文本）**：`{"type":"link","text":"飞书","link":"https://www.feishu.cn"}`。纯 URL 不需要 `rich_text`，直接写普通字符串即可。- **@人**：`{"type":"mention","mention_token":"<userId>","notify":false}`。**仅支持同租户用户，单次写入最多 50 人。** `notify` **默认 `true`**（会给被 @ 的人发通知），不想发务必显式传 `false`。- **@文档**：同样 `"type":"mention"`，`mention_token` 传文档 token（如 `shtXXX`）。

Inside this skill

7 instruction sections

The Skill claims to read, create, and edit Lark spreadsheets, including cells, worksheets, charts, pivots, filters, images, and history. Normal use therefore accesses online spreadsheets and may make persistent changes.

View source
SKILL.md:2In the instructionsOpen original file
---name: lark-sheetsversion: 3.1.8description: "飞书电子表格：创建和操作电子表格。支持创建表格、管理工作表与行列结构（增删/合并/调整尺寸/隐藏/冻结）、读写单元格（值/公式/样式/批注/单元格图片）、查找替换、多操作批量更新，以及图表、透视表、条件格式、筛选器、迷你图、浮动图片等对象的创建与维护。当用户需要创建电子表格、管理工作表、批量读写或编辑数据、统计汇总与可视化、表格美化、公式计算（含 Excel 公式迁移）、金融/财务建模（DCF、三张表、预算、Sensitivity 等）等任务时使用。若用户是想按名称或关键词搜索云空间（云盘/云存储）里的表格文件，请改用 lark-drive 的 drive +search 先定位资源。当用户给出 doubao.com 的 /sheets/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。"metadata:  requires:    bins: ["lark-cli"]    siblings: ["lark-shared"]  cliHelp: "lark-cli sheets --help"---

Most listed deletion and bulk-clear commands have an explicit high-risk approval flow: preview with dry-run, then add `--yes` only after the user agrees.

View source
SKILL.md:220In the instructionsOpen original file
> ⚠️ **high-risk-write 命令清单（exit 10 强确认门禁）**：`+batch-update`、`+cells-clear`、`+cells-batch-clear`、`+sheet-delete`、`+dim-delete`、`+dropdown-delete`，以及各对象删除 `+chart-delete` / `+pivot-delete` / `+cond-format-delete` / `+filter-delete` / `+filter-view-delete` / `+sparkline-delete` / `+float-image-delete`。>> **审批协议**：先 `--dry-run` 预览、向用户展示将执行的操作与影响范围，**获得用户明确同意后**再在原命令追加 `--yes` 执行。未经用户同意不得带 `--yes`，也不得在 exit 10 后静默补 `--yes` 重试——那等于禁用门禁。完整协议见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。

Authentication, permission handling, and the full approval protocol are delegated to `../lark-shared/SKILL.md`. Its contents are not present in the supplied evidence, so their scope and implementation cannot be independently verified from these lines.

View source
SKILL.md:14In the instructionsOpen original file
**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理。**
SKILL.md:215In the instructionsOpen original file
| --- | --- | --- | --- || `--dry-run` | bool | 否 | 零副作用：仅打印请求路径与参数模板，不发起调用；多步操作会输出每个子操作的请求模板 || `--yes` | bool | 是（仅 `high-risk-write`） | 二次确认；不带时退出码 10。详见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 高风险审批协议 || `--print-schema` | bool | 否 | 本地打印复合 JSON flag 的 JSON Schema 并退出，不发起调用、不需要其它 required flag。搭配 `--flag-name` 指定查哪个 flag；省略时列出该 shortcut 可查询的 flag。仅对含复合 JSON flag 的 shortcut 有效。 |
Start here · InstructionsSKILL.md
lark-sheets
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 34
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records29 files

Coverage and gaps

  • Some results did not pass evidence validation or finish processing. This report does not represent a complete check.
Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/lark_chart_layout_check.pyFull text included
  • scripts/lark_detect_subtables.pyFull text included
  • scripts/lark_inspect_workbook.pyFull text included
  • scripts/lark_profile_table.pyFull text included
  • scripts/lark_sheet_range.pyFull text included
  • scripts/lark_sheet_read_cli.pyFull text included
  • scripts/sheets_df.pyFull text included
  • references/lark-sheets-batch-update.mdFull text included
  • references/lark-sheets-changeset.mdFull text included
  • references/lark-sheets-chart.mdFull text included
  • references/lark-sheets-conditional-format.mdFull text included
  • references/lark-sheets-filter-view.mdFull text included
  • references/lark-sheets-filter.mdFull text included
  • references/lark-sheets-float-image.mdFull text included
  • references/lark-sheets-formula-translation.mdFull text included
  • references/lark-sheets-formula-verify.mdFull text included
  • references/lark-sheets-history.mdFull text included
  • references/lark-sheets-legacy-command-migration.mdFull text included
  • references/lark-sheets-pivot-table.mdFull text included
  • references/lark-sheets-range-operations.mdFull text included
  • references/lark-sheets-read-data.mdFull text included
  • references/lark-sheets-search-replace.mdFull text included
  • references/lark-sheets-sheet-structure.mdFull text included
  • references/lark-sheets-sparkline.mdFull text included
  • references/lark-sheets-styles-put.mdFull text included
  • references/lark-sheets-visual-standards.mdFull text included
  • references/lark-sheets-workbook.mdFull text included
  • references/lark-sheets-write-cells.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-sheets-batch-update.mdSupporting file
  • references/lark-sheets-changeset.mdSupporting file
  • references/lark-sheets-chart.mdSupporting file
  • references/lark-sheets-conditional-format.mdSupporting file
  • references/lark-sheets-filter-view.mdSupporting file
  • references/lark-sheets-filter.mdSupporting file
  • references/lark-sheets-float-image.mdSupporting file
  • references/lark-sheets-formula-translation.mdSupporting file
  • references/lark-sheets-formula-verify.mdSupporting file
  • references/lark-sheets-history.mdSupporting file
  • references/lark-sheets-legacy-command-migration.mdSupporting file
  • references/lark-sheets-pivot-table.mdSupporting file
  • references/lark-sheets-range-operations.mdSupporting file
  • references/lark-sheets-read-data.mdSupporting file
  • references/lark-sheets-search-replace.mdSupporting file
  • references/lark-sheets-sheet-structure.mdSupporting file
  • references/lark-sheets-sparkline.mdSupporting file
  • references/lark-sheets-styles-put.mdSupporting file
  • references/lark-sheets-visual-standards.mdSupporting file
  • references/lark-sheets-workbook.mdSupporting file
  • references/lark-sheets-write-cells.mdSupporting file
  • scripts/lark_chart_layout_check.pyScript
  • scripts/lark_detect_subtables.pyScript
  • scripts/lark_inspect_workbook.pyScript
  • scripts/lark_profile_table.pyScript
  • scripts/lark_sheet_range.pyScript
  • scripts/lark_sheet_read_cli.pyScript
  • scripts/sheets_df.pyScript

Operations mentioned in code and instructions

Run commands
scripts/lark_sheet_read_cli.py:8In the codeOpen original file
import jsonimport subprocessimport sys
scripts/lark_sheet_read_cli.py:68In the codeOpen original file
    try:        completed = subprocess.run(            cmd,
scripts/lark_sheet_read_cli.py:77In the codeOpen original file
        raise LarkCliError("lark-cli not found", cmd=cmd) from exc    except subprocess.TimeoutExpired as exc:        raise LarkCliError(f"lark-cli timed out after {timeout}s", cmd=cmd) from exc
Connect to websites
scripts/lark_chart_layout_check.py:268In the codeOpen original file
def _locator(target: str) -> dict[str, str]:    return {"url": target} if target.startswith(("http://", "https://")) else {"spreadsheet_token": target}
SKILL.md:208In the instructionsOpen original file
# 统一调用范式：两组定位缺一不可（占位符别原样填；表名先 +workbook-info 查）lark-cli sheets +csv-get --url "https://.../sheets/shtXXX" --sheet-name "<真实表名>" --range "A1:F30"```
references/lark-sheets-batch-update.md:166In the instructionsOpen original file
```bashlark-cli sheets +batch-update --url "https://example.feishu.cn/sheets/shtXXX" --yes \  --operations @ops.json
Lines read
7,231
File checksum (to compare versions)
580652fff53522fd7776ac100f30c469fe3818331a60ea3646a5fb4a1ba399c2