Feishu Comments

Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum...

Security Scan

The skill's code matches its stated purpose (read/resolve Feishu doc comments) but the package metadata omits that it reads local OpenClaw credentials and requires curl/python3 — a mismatch that warrants caution before installing.

Purpose & Capability

Name/description (fetching and resolving Feishu doc comments) aligns with the included scripts which call Feishu/Lark APIs and use appId/appSecret. However the skill metadata did not declare the need for Feishu credentials or system binaries, so the declared requirements do not fully reflect what the skill actually needs.

Instruction Scope

SKILL.md and the scripts explicitly instruct the agent to read ~/.openclaw/openclaw.json for appId/appSecret and domain, obtain a tenant_access_token, and call Feishu drive/docx APIs. Reading a user-local config file in the home directory is outside what the registry metadata declared and could expose other local configuration if the file contents differ from expectations.

Install Mechanism

No install spec — instruction-only with bundled scripts. No remote downloads or package installs are present, which keeps install risk low.

Credentials

The scripts require Feishu app credentials (appId/appSecret) and system binaries (curl, python3) but the skill metadata lists no required env vars or binaries. The missing declaration is a proportionality / transparency problem: the skill legitimately needs Feishu credentials for its purpose, but that need should be declared so users understand what they must provide and what will be accessed.

Persistence & Privilege

always is false and the skill does not request system-wide persistence or modify other skills' configs. It performs API calls and (optionally) patches comments via Feishu APIs, which is within its stated scope.

What to consider before installing

Before installing: review the two bundled scripts (get_comments.sh and resolve_comments.sh). They read your OpenClaw config at ~/.openclaw/openclaw.json to extract appId/appSecret and may call Feishu/Lark APIs to list or close comments. Confirm that you trust the skill owner and that ~/.openclaw/openclaw.json contains only the expected Feishu channel credentials. Be aware the resolve script will modify comments (auto-resolve orphaned or specified comment IDs) — test in a safe document or with a limited-permission Feishu app first. The registry metadata should have declared these requirements (credentials and curl/python3); the omission is likely an oversight but is a transparency risk. If you need higher assurance, request the author to (1) declare required credentials/binaries in metadata, (2) document exactly what is read from the config file, or (3) offer an option to pass credentials via a dedicated, minimal config or environment variables rather than reading your home config.

Feishu Document Comments

Fetch comments from Feishu docx documents via the Drive Comment API.

Requirements

• Feishu app credentials configured in ~/.openclaw/openclaw.json (reads appId and appSecret from channels.feishu)
• System dependencies: curl, python3 (must be available on PATH)
• Feishu app permission: docs:document.comment:read or drive:drive

Usage

Run the bundled script to get all comments on a document:

bash skills/feishu-comments/scripts/get_comments.sh <doc_token>

To fetch specific comments by ID:

bash skills/feishu-comments/scripts/get_comments.sh <doc_token> "id1,id2,id3"

Resolve skills/ paths relative to the workspace directory.

When to Use

• After feishu_doc list_blocks shows comment_ids on blocks
• When user asks to review or check comments on a document
• During document collaboration review cycles

Output Format

Each comment shows:

• Comment ID, status (Open/Resolved), scope (Global/Local)
• Quoted text (for local/inline comments)
• All replies with user ID and text content

Extracting doc_token

From URL https://xxx.feishu.cn/docx/ABC123def → doc_token = ABC123def

For wiki pages, first use feishu_wiki to get obj_token, then use that as the doc_token.

How It Works

The bundled shell script:

1. Reads Feishu app credentials (appId, appSecret) from ~/.openclaw/openclaw.json
2. Obtains a tenant_access_token via the Feishu auth API
3. Calls the Drive Comment API to list and batch-query comments
4. Formats and outputs comment content to stdout

No data is sent to any third party beyond the Feishu/Lark API endpoints.

Limitations

• Read-only (cannot create or reply to comments)
• API error responses are printed to stderr (may contain request IDs but no sensitive data)