Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenClaw飞书更新文档
v1.0.0更新飞书云文档。支持 7 种更新模式：追加、覆盖、定位替换、全文替换、前/后插入、删除。
⭐ 0· 99·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose is to update Feishu (飞书) cloud documents, which necessarily requires Feishu API authentication (app id/secret, tenant access token, OAuth token, or similar). The skill declares no required environment variables, no credentials, no binaries, and no install step — so there is a mismatch between the capability claimed and what would actually be needed to implement it.
Instruction Scope
The SKILL.md provides detailed modes (append, replace_range, replace_all, insert_before/after, delete_range, overwrite) and JSON payload examples (doc_id, mode, markdown), and it mentions async task_ids and warnings, but it never specifies how to transmit these payloads (no API endpoint, headers, HTTP method) or how to authenticate. That leaves broad, ambiguous authority to the agent/user to decide how/where to send data and could prompt requesting or entering sensitive tokens at runtime.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. From an install perspective there is no disk-write or external download risk.
Credentials
No environment variables or credentials are declared, yet updating Feishu docs would normally require credentials. The absence of declared auth is disproportionate to the operation. It implies the skill expects credentials to be supplied ad hoc (for example pasted into chat) or that some other skill/adapter provides them — both should be made explicit.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide configuration or modify other skills. Default autonomous invocation is allowed but not by itself suspicious here.
What to consider before installing
This skill describes how to modify Feishu documents but does not include the concrete runtime details — notably, it does not declare any Feishu credentials, API endpoints, or an install adapter. Before installing or invoking it:
- Do not paste your Feishu app secret, tenant token, or personal access token into chat. If the skill asks for tokens at runtime, prefer providing them via a secure environment variable or platform-secret mechanism, not inline.
- Ask the skill author for the missing details: the exact API endpoints it calls, the required auth scheme (app id/secret, tenant_access_token, OAuth), and whether it stores or logs tokens and where.
- Prefer skills that declare required env vars (e.g., FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_TENANT_TOKEN) and explain the auth flow.
- If you must use this skill, request source code or an adapter that performs authenticated API calls on your behalf, and verify it does not exfiltrate data to unknown endpoints.
Because the SKILL.md is otherwise detailed about editing modes, the inconsistency is likely an omission rather than outright maliciousness, but the omission materially affects safety — treat it as suspicious until the author provides the missing auth/endpoints and a clear privacy/security model.Like a lobster shell, security has layers — review code before you run it.
latestvk97758r3myqwanbvp468027mnd83rptn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.