feishu-doc-creator

Fail

Audited by Snyk on Mar 8, 2026

Risk Level: HIGH
Full Analysis

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

  • Secret detected (high risk: 1.00). I inspected the provided skill prompt for literal, high-entropy credentials. Two explicit string values appear inside the Python example parameters:
  • folder_token="DYPXf8ZktlOCIXdmGq3cfjevn2F"
  • parent_node_token="LmZ6wKwTViA4bSkVSYfcJGFcnRf"

These are not obvious placeholders (e.g., YOUR_API_KEY), are random-looking/high-entropy, and could be usable tokens granting access to cloud drive / wiki resources, so they meet the definition of a secret and should be flagged.

Other items in the document (environment variable names like FEISHU_APP_ID / FEISHU_APP_SECRET, and the descriptive passwords/placeholders guidance) are just names or placeholders and were ignored per the rules.

Audit Metadata
Risk Level
HIGH
Analyzed
Mar 8, 2026, 02:24 AM