Feishu Bot Manager CN

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its Feishu bot-management purpose, but its CLI can change OpenClaw configuration and restart the Gateway automatically while handling bot secrets.

Review the planned OpenClaw config changes before running this skill, protect the Feishu App Secret, and be aware that the current CLI restarts the Gateway immediately after saving changes. If you use the new-Agent workflow, inspect the generated governance and memory files afterward.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A bot-binding operation could disrupt active Gateway service or apply a bad configuration immediately instead of waiting for the user’s final restart approval.

Why it was flagged

The CLI restarts the OpenClaw Gateway immediately after writing configuration, with no prompt or approval check in the code.

Skill content

log.warning('正在重启 Gateway...');
try {
  execSync('openclaw gateway restart', { stdio: 'inherit' });

Recommendation

Only run the CLI after reviewing the exact changes, and prefer adding an explicit confirmation prompt before `openclaw gateway restart`.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone who can read the OpenClaw config file may be able to access the configured Feishu bot credentials.

Why it was flagged

The skill stores the Feishu App Secret in the local OpenClaw configuration, which is expected for this integration but still sensitive.

Skill content

config.channels.feishu.accounts[accountId] = {
  appId: appid,
  appSecret: appsecret,

Recommendation

Use only intended bot credentials, protect file permissions on ~/.openclaw/openclaw.json, and rotate the Feishu secret if it is exposed.

Low

#ASI06: Memory and Context Poisoning

What this means

Future Agent behavior may be influenced by persistent files created during this setup, and user preferences or decisions may be retained beyond the current chat.

Why it was flagged

When creating a new Agent, the skill instructs persistent memory and governance files to be written into that workspace.

Skill content

想长期保留的内容必须写文件，不能只靠会话记忆。
定期从近 7 天日志中提炼长期信息更新到 `MEMORY.md`

Recommendation

Review the generated AGENTS.md, MEMORY.md, SOUL.md, HEARTBEAT.md, and related files after creating a new Agent.