feishu-doc-creator
Fail
Audited by Snyk on Mar 8, 2026
Risk Level: HIGH
Full Analysis
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I inspected the provided skill prompt for literal, high-entropy credentials. Two explicit string values appear inside the Python example parameters:
- folder_token="DYPXf8ZktlOCIXdmGq3cfjevn2F"
- parent_node_token="LmZ6wKwTViA4bSkVSYfcJGFcnRf"
These are not obvious placeholders (e.g., YOUR_API_KEY), are random-looking/high-entropy, and could be usable tokens granting access to cloud drive / wiki resources, so they meet the definition of a secret and should be flagged.
Other items in the document (environment variable names like FEISHU_APP_ID / FEISHU_APP_SECRET, and the descriptive passwords/placeholders guidance) are just names or placeholders and were ignored per the rules.
Audit Metadata