Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Lark Sheets Skill Security Audit

What the author says it does (original text)

飞书电子表格：创建和操作电子表格。支持创建表格、管理工作表与行列结构（增删/合并/调整尺寸/隐藏/冻结）、读写单元格（值/公式/样式/批注/单元格图片）、查找替换、多操作批量更新，以及图表、透视表、条件格式、筛选器、迷你图、浮动图片等对象的创建与维护。当用户需要创建电子表格、管理工作表、批量读写或编辑数据、统计汇总与可视化、表格美化、公式计算（含 Excel 公式迁移）、金融/财务建模（DCF、三张表、预算、Sensitivity 等）等任务时使用。若用户是想按名称或关键词搜索云空间（云盘/云存储）里的表格文件，请改用 lark-drive 的 drive +search 先定位资源。当用户给出 doubao.com 的 /sheets/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域

Independent security check

Do not install or run it yet

Files checked
29
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Failed formulas may be downgraded to non-updating static values without prior consent

Source references: 2
What we found

The main rules allow switching to static values after three failed formula attempts, with disclosure only at delivery; the diagnostic guide also permits this when repair is considered too costly. This changes the nature of the requested output.

Why this matters

The sheet may look correct initially but will not recalculate when source data changes. Budgets, financial models, summaries, or decision data can silently become stale before the user notices the delivery note.

The source permits replacing a formula with a static value after three failures, with disclosure only at delivery; another section also permits fallback when fixing is too costly. Static values do not update with source data, so this materially changes the result when linked formulas were expected, without requiring prior consent. Users can require a pause for approval after formula failure or prohibit static fallback.

SKILL.md:36In the instructions
3. **读全再写**：批量填充 / 补齐 / 修正类任务先确认真实数据末行再写，只探前 N 行会漏写表尾（确定末行流程见 `lark-sheets-read-data`）。4. **公式优先于硬编码**：凡可由表内其它单元格推导的值（总计 / 占比 / 增长率 / 提取 / 查找）一律写公式，即使用户没说"联动 / 自动更新"——本地算好再静默写进单元格，交付的是改输入不重算的死表。提取类产出同行源列的连续原文片段（逐字保真、不跨列取材，一格含多个片段要全列出）；语义判断类（无固定分隔符 / 模式可循）公式表达不了，逐行写静态值，别用固定偏移 / 通用正则硬套。输入列可能为空时公式先判空返回空（空格按 0 参与算术产出无错误码的错值，`IFERROR` 拦不住）。**写聚合公式（SUM / COUNTIF / AVERAGE 等）前先确认区间的起止两端**：起点跳过表头行、终点覆盖真实末行——漏掉末行或把表头算进计数是最常见的错值来源，且结果看着合理、不报错；写完抽查区间首尾两格确认落在数据内。写飞书公式前读 `lark-sheets-formula-translation`，落表后用 `+formula-verify` 诊断。试错 3 次仍失败可降级静态值，交付说明写明「静态值 + 失败原因 + 不随源数据更新」。5. **续写 / 扩展继承样式**：续写、补齐、复制区块、新增行列时禁止只读值只写值——原表的字体 / 字号 / 颜色、四边框、对齐、底色（含奇偶行交替）、行高列宽、合并都要一并延续到新区域，**判分与验收都按"新区域与相邻原始区域视觉一致"来看**。
Show 1 other places
references/lark-sheets-formula-verify.md:52In the instructions
2. `status='partial'` → 扫描被内部上限截断。若该公式区是关键输出，可缩小 `--range` 或拆 `--sheet-id` 续扫；否则在交付说明中标明诊断覆盖不完整。3. `status='errors_found'` 且 `compile_errors[]` 非空 → 根据 `compile_errors[].reason` 修正公式语法（飞书函数名 / 范围语法 / 引用样式），或在成本过高时降级为静态值并说明原因。4. `status='errors_found'` 且只剩运行时错误 → 按 `error_summary` 的 `samples[].formula` + `depends_on` 排查根因（零除？空值参与运算？引用越界？日期差写法？数组语义？），优先修复关键输出区。5. 同一处错误连续修复 3 次仍未通过 → 改用 `IFERROR` 包裹兜底，或退回纯值写入，并在交付说明写清不随源数据更新。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 3
High risk

Whole-workbook revert is labeled high risk but lacks the mandatory confirmation gate

Source references: 5
What we found

History revert replaces the current workbook with an older version and is explicitly labeled high-risk, yet `+history-revert` is absent from the main gated-command list, exposes no `--yes` flag, and is executed directly in the example.

Why this matters

Selecting the wrong version or workbook, or misunderstanding a partial-undo request, could overwrite the current workbook. The initial asynchronous acceptance also does not mean the final result is complete or controlled.

The source supports this risk: workbook-wide revert overwrites current content and is expressly called high risk, yet its flags and execution example contain no `--yes`, and it is absent from the main gated-command list. Following the example could overwrite the current workbook without enforced second confirmation. Users can ask that `+history-revert` use the same dry-run, impact display, and explicit-consent gate.

references/lark-sheets-history.md:7In the instructions
回滚（revert）把电子表格的当前内容覆盖回某个历史版本——这是一个**高风险写入**操作，且为**异步**：发起后立即返回受理标识，真正的回滚在后台进行，需通过状态查询轮询最终结果（进行中 / 成功 / 失败）。`+history-list` 读取版本列表以挑选目标；`+history-revert` 发起回滚；`+history-revert-status` 轮询回滚结果。若只是想拿**当前文档版本号（revision）**当作 recover / undo / `+changeset-get` 的起点锚点，直接用 `+revision-get` 更轻量。
Show 4 other places
references/lark-sheets-history.md:32In the instructions
| Shortcut | Risk | 分组 || --- | --- | --- || `+history-list` | read | 历史版本 || `+history-revert` | high-risk-write | 历史版本 || `+history-revert-status` | read | 历史版本 |
references/lark-sheets-history.md:48In the instructions
### `+history-revert`_公共：URL/token（无 sheet 定位） · 系统：`--dry-run`_| Flag | Type | 必填 | 说明 || --- | --- | --- | --- || `--history-version-id` | string | required | 要回滚到的历史版本（取自 +history-list） |
SKILL.md:220In the instructions
> ⚠️ **high-risk-write 命令清单（exit 10 强确认门禁）**：`+batch-update`、`+cells-clear`、`+cells-batch-clear`、`+sheet-delete`、`+dim-delete`、`+dropdown-delete`，以及各对象删除 `+chart-delete` / `+pivot-delete` / `+cond-format-delete` / `+filter-delete` / `+filter-view-delete` / `+sparkline-delete` / `+float-image-delete`。>> **审批协议**：先 `--dry-run` 预览、向用户展示将执行的操作与影响范围，**获得用户明确同意后**再在原命令追加 `--yes` 执行。未经用户同意不得带 `--yes`，也不得在 exit 10 后静默补 `--yes` 重试——那等于禁用门禁。完整协议见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。
references/lark-sheets-history.md:81In the instructions
### `+history-revert````bash# 回滚到指定历史版本（异步受理）lark-cli sheets +history-revert --url "https://sample.feishu.cn/sheets/SHTxxxxxx" --history-version-id "<id-from-history-list>"```
Medium risk

Ordinary CSV writes overwrite by default, and a small supplied range does not bound the write

Source references: 3
What we found

For `+csv-put`, the location is only a top-left anchor; the CSV expands according to its own dimensions and overwrite is enabled by default. This command does not use the high-risk `--yes` gate.

Why this matters

An extra row or column, or CSV quoting that splits one formula into multiple fields, can write beyond the area the user expected and overwrite adjacent cells.

The source states that `+csv-put` treats the location only as a top-left anchor, expands according to the CSV's own dimensions, and overwrites non-empty cells by default; a seemingly small range does not bound the write. Dry-run and `allow-overwrite=false` are recommended but not enforced. A wrong anchor or CSV shape could overwrite adjacent data. Users can require no-overwrite by default and review the actual `writes_range` before execution.

references/lark-sheets-write-cells.md:527In the instructions
>> ⚠️ **公式内部含逗号 / 引号建议 RFC 4180 转义**：CSV 用逗号分隔字段，公式里的逗号（如 `COUNTIF(D5:D22,"及格")` 的参数分隔逗号）会被解析器当成字段分隔符，把一格拆成多格、整块二维结构压扁错位。规则：**含逗号的字段整格用双引号包裹，字段内部的引号再翻倍**：>> ```bash> # 从 G4 写一个 2 列 3 行的统计块；=COUNTIF 含逗号 + 内部引号，建议转义> lark-cli sheets +csv-put --url "..." --sheet-name "Sheet1" \>   --start-cell "G4" \>   --csv $'统计项,结果\n成绩总和,=SUM(C5:C22)\n及格人数,"=COUNTIF(D5:D22,""及格"")"'> # ↑ "=COUNTIF(D5:D22,""及格"")"：外层双引号包裹整格，内部 "及格" 的引号翻倍成 ""及格""。> # 裸写 =COUNTIF(D5:D22,"及格") 会被 CSV 按逗号拆成两格、写入区域从 G4:H6 错位成 G4:K4。> ```
Show 2 other places
references/lark-sheets-write-cells.md:546In the instructions
> **定位 + 写入边界（关键，避免误覆盖）**：> - 定位用 `--start-cell`（锚点 = 左上角单元格）；也接受 `--range` 别名（与 `+csv-get` / `+cells-set` 一致，传区间会自动取左上角）。> - ⚠️ `--start-cell` / `--range` **只定左上角、不限制写入大小**：CSV 从锚点按自身行列数 auto-expand 铺开。给一个"小 range"**不会**截断数据——超出部分照写，且默认覆盖。这与 `+cells-set --range`（精确矩形、`--cells` 必须与 range 同维）语义相反，别把那套心智搬过来。> - dry-run 与成功响应都回显 `writes_range`（实际落区，如 `B2:D4`）：**写前先 `--dry-run` 看一眼落区**，确认不会盖到相邻数据。> - 要保护非空 cell：`--allow-overwrite=false`（落区内出现非空 cell 即报错）。
references/lark-sheets-write-cells.md:127In the instructions
- 不要把 `cells` 写成字符串化 JSON- `+cells-set` 默认即覆盖非空 cell（`--allow-overwrite` 默认 true）；若要**保护**非空 cell 不被覆盖，显式传 `--allow-overwrite=false`（遇非空 cell 报错）- 若目标区域涉及合并单元格，不要向合并区域中的非左上角单元格写入数据；如需写入，应改写合并区域左上角单元格，或先调整/取消合并区域- **构造 `range` 时行号建议基于逻辑行号**：如果之前通过 `+csv-get` 读取了数据，CSV 中被双引号包裹的多行字段（如 `"2026年3月2日\n星期一"`）是**一个单元格**，不是两行。写入时的行号建议按逻辑记录计算，不能按物理换行符计数，否则 `range` 会整体偏移导致写入到错误位置
Medium risk

Find-and-replace can modify an entire worksheet when range is omitted, without an enforced confirmation gate

Source references: 5
What we found

`+cells-replace` is classified as an ordinary write. Its range is optional and omission means the whole sheet; an empty replacement can also remove matching content. Search and dry-run are recommended, but the command does not require `--yes`.

Why this matters

A broad keyword, incorrect regular expression, or formula-inclusive replacement could change many unrelated cells or formulas in one operation; the documentation describes the side effect as irreversible.

The source supports the risk, though it includes mitigations. `+cells-replace` is ordinary write; omitting `--range` targets the whole sheet, an empty replacement deletes matching text, and no `--yes` gate is required. The documentation calls for scope clarification, match counting, verification, and strongly recommends dry-run, but direct execution remains possible. A broad term or regex could cause mass unintended edits. Users can require an explicit range and confirmation of previewed matches.

references/lark-sheets-search-replace.md:5In the instructions
`+cells-replace` 的副作用是不可逆的（除非另写代码回滚）。执行前必须：1. **明确替换范围**：建议显式说明"只替换 X 列 / X 区域，还是全表替换"。避免默认全表替换——容易误改无关列。范围应由用户指令决定，模糊时主动询问。2. **dry-run 命中数量**：先用 `+cells-search` 在同一范围、同一关键词、同一匹配选项（大小写 / 精确 / 正则）下统计命中数量。把数量和**期望命中数**（用户明示的或基于业务理解推断的）对照；不一致先排查（关键词太宽？范围太大？）。3. **替换后回读校验**：执行后再次 `+cells-search` 旧关键词，预期为 0；并对替换后的若干代表性单元格回读确认值符合预期。
Show 4 other places
references/lark-sheets-search-replace.md:27In the instructions
| Shortcut | Risk | 分组 || --- | --- | --- || `+cells-search` | read | 单元格 || `+cells-replace` | write | 单元格 |
references/lark-sheets-search-replace.md:53In the instructions
| Flag | Type | 必填 | 说明 || --- | --- | --- | --- || `--find` | string | required | 待替换文本 || `--replacement` | string | required | 替换为；传空字符串 `""` 等价于「删除内容」 || `--range` | string | optional | 替换范围（A1 格式）；省略时整表 || `--match-case` | bool | optional | 大小写敏感 || `--match-entire-cell` | bool | optional | 完全匹配整个单元格 || `--regex` | bool | optional | 把 `--find` 按正则解释 || `--include-formulas` | bool | optional | 也在公式文本中替换 |
references/lark-sheets-search-replace.md:55In the instructions
| --- | --- | --- | --- || `--find` | string | required | 待替换文本 || `--replacement` | string | required | 替换为；传空字符串 `""` 等价于「删除内容」 || `--range` | string | optional | 替换范围（A1 格式）；省略时整表 || `--match-case` | bool | optional | 大小写敏感 || `--match-entire-cell` | bool | optional | 完全匹配整个单元格 || `--regex` | bool | optional | 把 `--find` 按正则解释 || `--include-formulas` | bool | optional | 也在公式文本中替换 |
references/lark-sheets-search-replace.md:105In the instructions
> `+cells-replace` 虽然 Risk = write，但范围大或正则错可能改一堆。**强烈推荐工作流**：先 `+cells-search` 看匹配数，再 `+cells-replace --dry-run` 预览，最后真正执行。
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Rich-text mentions notify other people by default

Source references: 2
What we found

For a `mention`, `notify` defaults to true. The documentation says to set it false when notification is unwanted, but does not require explicit consent before this external notification is triggered.

Why this matters

In a shared or sensitive spreadsheet, an accidental notification can reveal workbook activity and related context to the mentioned person and create an irreversible interruption.

The source explicitly says a rich-text `mention` defaults `notify` to true and sends a notification to the mentioned person unless false is specified. This affects another user outside the workbook, yet the documentation does not require explicit consent before sending. The risk arises only when writing a person mention without setting false. Users can require `notify:false` by default and enable notifications only when expressly requested.

references/lark-sheets-write-cells.md:173In the instructions
## 富文本单元格：超链接 / @人 / @文档（`rich_text`）带显示文本的超链接、@人、@文档这类富内容**建议**走 `+cells-set` 的 `rich_text` 字段（`cells[].rich_text` 数组，每段一个对象、带 `type`），**不能**直接传普通字符串——纯字符串只会被当作纯文本存进单元格。完整字段跑 `lark-cli sheets +cells-set --print-schema --flag-name cells`，常用段类型：- **超链接（带显示文本）**：`{"type":"link","text":"飞书","link":"https://www.feishu.cn"}`。纯 URL 不需要 `rich_text`，直接写普通字符串即可。- **@人**：`{"type":"mention","mention_token":"<userId>","notify":false}`。**仅支持同租户用户，单次写入最多 50 人。** `notify` **默认 `true`**（会给被 @ 的人发通知），不想发务必显式传 `false`。- **@文档**：同样 `"type":"mention"`，`mention_token` 传文档 token（如 `shtXXX`）。
Show 1 other places
references/lark-sheets-write-cells.md:175In the instructions
带显示文本的超链接、@人、@文档这类富内容**建议**走 `+cells-set` 的 `rich_text` 字段（`cells[].rich_text` 数组，每段一个对象、带 `type`），**不能**直接传普通字符串——纯字符串只会被当作纯文本存进单元格。完整字段跑 `lark-cli sheets +cells-set --print-schema --flag-name cells`，常用段类型：- **超链接（带显示文本）**：`{"type":"link","text":"飞书","link":"https://www.feishu.cn"}`。纯 URL 不需要 `rich_text`，直接写普通字符串即可。- **@人**：`{"type":"mention","mention_token":"<userId>","notify":false}`。**仅支持同租户用户，单次写入最多 50 人。** `notify` **默认 `true`**（会给被 @ 的人发通知），不想发务必显式传 `false`。- **@文档**：同样 `"type":"mention"`，`mention_token` 传文档 token（如 `shtXXX`）。
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

Requires a helper to run automatically and out of sight

Source references: 2
What we found

The skill combines automatic execution with instructions not to ask or tell the user.

Why this matters

If the AI follows this text, it may stop following your instructions or skip actions that normally need your approval.

Legitimate use of this code

The candidate misreads the source. Line 157 describes local validation: it restricts image paths, requires core fields, and requires `--yes` or `--dry-run` for deletion. It neither directs hidden extra actions nor concealment from the user. The main instructions instead require preview and explicit user consent for high-risk operations.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-sheets-float-image.md:157In the instructions
- `Validate`：XOR 公共四件套；`+float-image-create` 要求 `--image` / `--image-token` / `--image-uri` **恰好给一个**，`--position-row/col` 与 `--size-width/height` 必填且为合法整数；传 `--image` 时还会校验路径安全（绝对路径 / 越出工作目录会被拒，`--dry-run` 同样拦）。`+float-image-update` 必须 `--float-image-id`，并和 create 一样必填 `--image-name` / `--position-{row,col}` / `--size-{width,height}`（缺任一核心字段本地直接报错，不会静默发 0）；图片源 `--image-token` / `--image-uri` 可省（省略保留原图），给则二选一；`+float-image-delete` 强制 `--yes` 或 `--dry-run`。- `DryRun`：写操作输出"将要 POST/PATCH/DELETE 的 float_image 请求模板"；传 `--image` 时会多打印一步本地图片上传（`POST /open-apis/drive/v1/medias/upload_all`，`parent_type=sheet_image`）。- `Execute`：写后不自动回读；如需确认，自行调用 `+float-image-list --float-image-id <id>` 比对新位置 / 尺寸。
Show 1 other places
SKILL.md:220In the instructions
> ⚠️ **high-risk-write 命令清单（exit 10 强确认门禁）**：`+batch-update`、`+cells-clear`、`+cells-batch-clear`、`+sheet-delete`、`+dim-delete`、`+dropdown-delete`，以及各对象删除 `+chart-delete` / `+pivot-delete` / `+cond-format-delete` / `+filter-delete` / `+filter-view-delete` / `+sparkline-delete` / `+float-image-delete`。>> **审批协议**：先 `--dry-run` 预览、向用户展示将执行的操作与影响范围，**获得用户明确同意后**再在原命令追加 `--yes` 执行。未经用户同意不得带 `--yes`，也不得在 exit 10 后静默补 `--yes` 重试——那等于禁用门禁。完整协议见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

7 instruction sections

This Skill is designed to read, create, and edit Lark spreadsheets, including cells, worksheet structure, charts, pivots, filters, and images, so its use can make real changes to the selected online workbook.

View source
SKILL.md:2In the instructions
---name: lark-sheetsversion: 3.1.8description: "飞书电子表格：创建和操作电子表格。支持创建表格、管理工作表与行列结构（增删/合并/调整尺寸/隐藏/冻结）、读写单元格（值/公式/样式/批注/单元格图片）、查找替换、多操作批量更新，以及图表、透视表、条件格式、筛选器、迷你图、浮动图片等对象的创建与维护。当用户需要创建电子表格、管理工作表、批量读写或编辑数据、统计汇总与可视化、表格美化、公式计算（含 Excel 公式迁移）、金融/财务建模（DCF、三张表、预算、Sensitivity 等）等任务时使用。若用户是想按名称或关键词搜索云空间（云盘/云存储）里的表格文件，请改用 lark-drive 的 drive +search 先定位资源。当用户给出 doubao.com 的 /sheets/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。"metadata:

The included analysis scripts invoke `lark-cli` with argument arrays and use workbook, structure, cell, and chart read commands; the visible wrapper does not execute shell command strings. Authentication and permission handling are delegated to an unprovided `../lark-shared/SKILL.md`, so that portion cannot be verified from this evidence.

View source
scripts/lark_sheet_read_cli.py:59In the code
    cmd = ["lark-cli", "sheets", shortcut]    _append_flag(cmd, "url", url)    _append_flag(cmd, "spreadsheet_token", spreadsheet_token)    _append_flag(cmd, "sheet_id", sheet_id)    _append_flag(cmd, "sheet_name", sheet_name)    for key, value in (flags or {}).items():        _append_flag(cmd, key, value)    try:        completed = subprocess.run(            cmd,            capture_output=True,            text=True,            timeout=timeout,            check=False,        )    except FileNotFoundError as exc:
SKILL.md:14In the instructions
**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理。**

For the listed delete, clear, and batch commands, the Skill defines an approval flow of dry-run, showing the impact, obtaining explicit consent, and only then adding `--yes`; this is the main visible safeguard.

View source
SKILL.md:220In the instructions
> ⚠️ **high-risk-write 命令清单（exit 10 强确认门禁）**：`+batch-update`、`+cells-clear`、`+cells-batch-clear`、`+sheet-delete`、`+dim-delete`、`+dropdown-delete`，以及各对象删除 `+chart-delete` / `+pivot-delete` / `+cond-format-delete` / `+filter-delete` / `+filter-view-delete` / `+sparkline-delete` / `+float-image-delete`。>> **审批协议**：先 `--dry-run` 预览、向用户展示将执行的操作与影响范围，**获得用户明确同意后**再在原命令追加 `--yes` 执行。未经用户同意不得带 `--yes`，也不得在 exit 10 后静默补 `--yes` 重试——那等于禁用门禁。完整协议见 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。

Local images and workbook files can be uploaded or imported into Lark. Images are uploaded as `sheet_image`, while workbook imports default to the cloud-space root. Users should treat these operations as uploading the complete selected file to their Lark account.

View source
references/lark-sheets-float-image.md:28In the instructions
图片来源有三种方式，`+float-image-create` 上三者 **XOR、必给其一**（`--image` / `--image-token` / `--image-uri`）：- **`--image <本地路径>`（首选，最省事）**：直接给本地图片文件路径（PNG/JPEG/GIF/BMP/HEIC 等）。CLI 会自动把它以 `parent_type=sheet_image` 上传，拿到 file_token 后创建浮动图，**不用你手动上传 / 取 token**。路径规则同其它本地文件 flag：必须是当前工作目录内的相对路径（绝对路径会被 Validate 拒，`--dry-run` 也会拦）。- `--image-token`：复用**已存在**的图片 file_token。常见来源：① `+float-image-list` 返回的 `image_token`（适合"换皮不换位置"复用同一张图）；② `+cells-set-image` 成功返回里的 `file_token`（它也是 `sheet_image` 上传句柄）。适合"同一张图复用到多处"，省去重复上传。- `--image-uri`：图片 URI（上传链路返回的句柄），**非**表内对象 reference_id；由系统自动转 file_token。
references/lark-sheets-workbook.md:168In the instructions
### `+workbook-import`| Flag | Type | 必填 | 说明 || --- | --- | --- | --- || `--file` | string | required | 本地文件路径（.xlsx / .xls / .csv） || `--folder-token` | string | optional | 目标文件夹 token；省略则导入到云空间根目录 || `--name` | string | optional | 导入后表格名称；省略则用本地文件名（去掉扩展名） |
Start here · InstructionsSKILL.md
lark-sheets
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 34
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records29 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/lark_chart_layout_check.pyFull text included
  • scripts/lark_detect_subtables.pyFull text included
  • scripts/lark_inspect_workbook.pyFull text included
  • scripts/lark_profile_table.pyFull text included
  • scripts/lark_sheet_range.pyFull text included
  • scripts/lark_sheet_read_cli.pyFull text included
  • scripts/sheets_df.pyFull text included
  • references/lark-sheets-batch-update.mdFull text included
  • references/lark-sheets-changeset.mdFull text included
  • references/lark-sheets-chart.mdFull text included
  • references/lark-sheets-conditional-format.mdFull text included
  • references/lark-sheets-filter-view.mdFull text included
  • references/lark-sheets-filter.mdFull text included
  • references/lark-sheets-float-image.mdFull text included
  • references/lark-sheets-formula-translation.mdFull text included
  • references/lark-sheets-formula-verify.mdFull text included
  • references/lark-sheets-history.mdFull text included
  • references/lark-sheets-legacy-command-migration.mdFull text included
  • references/lark-sheets-pivot-table.mdFull text included
  • references/lark-sheets-range-operations.mdFull text included
  • references/lark-sheets-read-data.mdFull text included
  • references/lark-sheets-search-replace.mdFull text included
  • references/lark-sheets-sheet-structure.mdFull text included
  • references/lark-sheets-sparkline.mdFull text included
  • references/lark-sheets-styles-put.mdFull text included
  • references/lark-sheets-visual-standards.mdFull text included
  • references/lark-sheets-workbook.mdFull text included
  • references/lark-sheets-write-cells.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-sheets-batch-update.mdSupporting file
  • references/lark-sheets-changeset.mdSupporting file
  • references/lark-sheets-chart.mdSupporting file
  • references/lark-sheets-conditional-format.mdSupporting file
  • references/lark-sheets-filter-view.mdSupporting file
  • references/lark-sheets-filter.mdSupporting file
  • references/lark-sheets-float-image.mdSupporting file
  • references/lark-sheets-formula-translation.mdSupporting file
  • references/lark-sheets-formula-verify.mdSupporting file
  • references/lark-sheets-history.mdSupporting file
  • references/lark-sheets-legacy-command-migration.mdSupporting file
  • references/lark-sheets-pivot-table.mdSupporting file
  • references/lark-sheets-range-operations.mdSupporting file
  • references/lark-sheets-read-data.mdSupporting file
  • references/lark-sheets-search-replace.mdSupporting file
  • references/lark-sheets-sheet-structure.mdSupporting file
  • references/lark-sheets-sparkline.mdSupporting file
  • references/lark-sheets-styles-put.mdSupporting file
  • references/lark-sheets-visual-standards.mdSupporting file
  • references/lark-sheets-workbook.mdSupporting file
  • references/lark-sheets-write-cells.mdSupporting file
  • scripts/lark_chart_layout_check.pyScript
  • scripts/lark_detect_subtables.pyScript
  • scripts/lark_inspect_workbook.pyScript
  • scripts/lark_profile_table.pyScript
  • scripts/lark_sheet_range.pyScript
  • scripts/lark_sheet_read_cli.pyScript
  • scripts/sheets_df.pyScript

Operations mentioned in code and instructions

Run commands
scripts/lark_sheet_read_cli.py:8In the code
import jsonimport subprocessimport sys
scripts/lark_sheet_read_cli.py:68In the code
    try:        completed = subprocess.run(            cmd,
scripts/lark_sheet_read_cli.py:77In the code
        raise LarkCliError("lark-cli not found", cmd=cmd) from exc    except subprocess.TimeoutExpired as exc:        raise LarkCliError(f"lark-cli timed out after {timeout}s", cmd=cmd) from exc
Connect to websites
scripts/lark_chart_layout_check.py:268In the code
def _locator(target: str) -> dict[str, str]:    return {"url": target} if target.startswith(("http://", "https://")) else {"spreadsheet_token": target}
SKILL.md:208In the instructions
# 统一调用范式：两组定位缺一不可（占位符别原样填；表名先 +workbook-info 查）lark-cli sheets +csv-get --url "https://.../sheets/shtXXX" --sheet-name "<真实表名>" --range "A1:F30"```
references/lark-sheets-batch-update.md:166In the instructions
```bashlark-cli sheets +batch-update --url "https://example.feishu.cn/sheets/shtXXX" --yes \  --operations @ops.json
Lines read
7,231
File checksum (to compare versions)
d2d3bb08a9e4d87e6f3a95ca8ae054272a6bbdba3867ba635d8b0e215aacfcea