Feishu Group

Teach OpenClaw how to work in Feishu (Lark) group chats — recognize who's talking, behave properly in groups vs DMs, respect multi-user privacy, and format m...

Security Scan

The skill's code and instructions are consistent with its stated purpose (pull Feishu contacts and teach group/DM behavior); it reads app credentials from your openclaw.json and updates USER.md, which is expected for this functionality.

Purpose & Capability

The name/description match the actual behavior: SKILL.md explains group/DM etiquette and the included script fetches Feishu contacts to populate USER.md so the agent can map open_id→name. Asking to read app credentials from openclaw.json is coherent for contacting Feishu.

Instruction Scope

Runtime instructions are narrowly scoped: run the sync script (reads a provided config file), update USER.md, restart gateway, and optionally set a cron job. There are no instructions to read unrelated system files or to transmit data to endpoints other than Feishu.

Install Mechanism

No install spec is provided (instruction-only) and the bundled Python script uses only standard libraries and official Feishu API endpoints (open.feishu.cn). No downloads from untrusted URLs or archive extraction occur.

Credentials

The skill declares no environment variables, but the script requires Feishu app credentials (appId/appSecret) stored in the openclaw.json you pass to it. This is proportionate to the task, but the skill does not explicitly declare those required credentials in registry metadata—ensure your openclaw.json is secured and only contains least-privilege credentials.

Persistence & Privilege

The skill does not request always:true and does not modify other skills. It writes to USER.md (workspace file) and suggests a cron job for periodic sync; that introduces persistent behavior under your control but is expected for contact-sync functionality.

Assessment

This skill appears to do what it says: it uses your Feishu app credentials (appId/appSecret) from openclaw.json to call Feishu's official API and writes a contacts table into USER.md so the agent can resolve open_id → name. Before installing/running: (1) Inspect and protect the openclaw.json file (store credentials with proper file permissions and use least-privilege app credentials such as contact:user.base:readonly). (2) Review the script (it is short and uses only the Feishu endpoints shown). (3) Be aware the script will modify USER.md — back it up if needed. (4) If you add the suggested cron job, schedule it only on hosts you control and monitor network access. If you want stricter controls, provision a dedicated Feishu app with only contact-read scope and use that account for syncing.

Everything your OpenClaw agent needs to be a good Feishu group chat participant.

1. Know who you're talking to

Feishu group messages include sender names in metadata. DMs don't — they only include an opaque open_id. Without setup, your agent will assume all DMs come from one person.

Fix: Embed an open_id → name lookup table in USER.md. Since workspace files are injected into the system prompt, the agent matches senders instantly — no tool calls.

Run the bundled sync script to pull your org's contacts:

python3 scripts/sync_feishu_contacts.py <openclaw_config> <feishu_account> <user_md_path>

This populates a table in USER.md:

## 飞书通讯录 (App Name)
飞书 DM 不携带发送者姓名。用 inbound metadata 的 chat_id（格式 `user:ou_xxx`）匹配下表识别发送者。
| 姓名 | open_id |
|------|---------|
| Alice | ou_abc123 |
| Bob | ou_def456 |

Important: Feishu open_id is per-app. Multiple OpenClaw instances using different Feishu apps must each pull contacts with their own credentials.

After updating USER.md, restart the gateway. Workspace files are cached at startup; /new alone won't pick up changes.

Set up weekly auto-sync via crontab:

0 7 * * 1 python3 /path/to/scripts/sync_feishu_contacts.py ~/.openclaw/openclaw.json my_app ~/workspace/USER.md

2. Group chat etiquette

Add to AGENTS.md or SOUL.md:

When to respond:

• Directly @mentioned
• Can add real value to the conversation
• Something witty or relevant fits naturally

When to stay silent:

• Casual banter you have nothing to add to
• Someone already answered well
• "Yeah" / "Nice" / emoji-only territory

General rules:

• Don't dominate the conversation — participate, don't monologue
• One reaction per message max
• Keep replies concise — respect the group's attention

3. DM behavior

• Always address the sender by their actual name (look up from the contacts table)
• Never assume a DM is from your "primary human" — anyone can message you
• Keep conversations isolated — never leak what person A said to person B
• Be more thorough in DMs than in groups (the person came to you specifically)

4. Platform formatting

Feishu does NOT render Markdown well. Follow these rules:

• No markdown: No **bold**, # headers, or [links](url) in messages
• No tables: Use simple lists with dashes instead
• Plain text only: Use line breaks and spacing for structure
• Code blocks: Feishu does support code blocks — use sparingly

5. Multi-user privacy

Add to SOUL.md or AGENTS.md:

• Different users' conversation contents are isolated from each other
• Don't reveal what A discussed with you to B, even if B is the admin
• Each person's DM is a private space
• In group chats, don't share anyone's private information

6. Sender identification (AGENTS.md snippet)

Add this to your startup sequence:

识别消息发送者：飞书 DM 不携带发送者姓名，只有 open_id（inbound metadata 的 chat_id 格式 user:ou_xxx）。
提取 open_id，在 USER.md 的飞书通讯录表格中匹配找到姓名。
不要假设 DM 对方就是主人——任何人都可能给你发私聊。
群聊消息自带 Sender metadata 可直接使用。

Privacy

• Only names and open_ids are stored (no emails, phones, or PII)
• open_id is opaque, meaningful only within your Feishu app
• App credentials are read at runtime from openclaw.json, never stored in skill files