Feishu Thread Forward

Forward Feishu thread/topic to a user, group, or topic via REST API. Activate when: forwarding a thread/topic to another chat, sharing a topic post to a diff...

Security Scan

The skill does what it says (forwards Feishu threads), but it quietly reads a global OpenClaw config file for credentials that the metadata does not declare, which is disproportionate and could expose other secrets.

Purpose & Capability

Functionality (forwarding Feishu threads via Feishu Open API) matches the name/description and the included script implements that flow. However the skill's metadata declares no credentials or config paths, while the code and SKILL.md require reading /root/.openclaw/openclaw.json to obtain appId/appSecret — this omission is inconsistent with the stated purpose/requirements.

Instruction Scope

SKILL.md and the script instruct the agent to read /root/.openclaw/openclaw.json to get channels.feishu.appId and appSecret and then call Feishu APIs. Reading a global OpenClaw config file is scope-expanding because that file may contain credentials for multiple channels; the instructions do not constrain or justify reading the entire file or declare that access.

Install Mechanism

No install spec (instruction-only plus a small helper script). No downloads or archive extraction. The script uses standard Python stdlib (urllib) and performs straightforward HTTP calls — low install risk.

Credentials

The skill requires Feishu appId/appSecret but declares no required env vars or config paths in metadata. Instead it hardcodes a path (/root/.openclaw/openclaw.json). This is disproportionate because that global file likely contains other credentials/tokens; asking to read it without declaring it risks exposing unrelated secrets. The script does not exfiltrate data beyond Feishu endpoints, but local file access is overly broad and undeclared.

Persistence & Privilege

The skill is not always:true and does not request persistent system presence or modify other skills. It runs on demand and performs network calls only to Feishu endpoints.

What to consider before installing

This skill implements Feishu thread forwarding and needs Feishu appId/appSecret — that's expected — but it obtains them by reading /root/.openclaw/openclaw.json, a global OpenClaw config that may contain other secrets. Before installing: (1) inspect the file /root/.openclaw/openclaw.json to see what keys it contains; (2) prefer supplying only the Feishu credentials (or an explicit config path) rather than allowing the skill to read a global config; (3) ask the publisher to declare the required config path in the skill metadata or to accept credentials via environment variables; (4) only install if you trust the source, since the skill will read a local file and perform network requests to api.open.feishu.cn. If you cannot verify the config contents or trust the publisher, do not install.

Forward a Feishu thread (话题) to a user, group, or another topic using the Feishu Open API.

When to Use

• User asks to forward/share a thread or topic to another group or user
• You need to cross-post a topic post from one group to another
• The built-in message tool cannot do thread-level forwarding

API

POST https://open.feishu.cn/open-apis/im/v1/threads/{thread_id}/forward?receive_id_type={type}

Parameters

Param	Location	Required	Description
thread_id	path	yes	Thread ID to forward (format: omt_xxxxx)
receive_id_type	query	yes	Target ID type: open_id, chat_id, user_id, union_id, email, thread_id
receive_id	body	yes	Target ID matching the receive_id_type
uuid	query	no	Idempotency key (max 50 chars, dedup within 1 hour)

Headers

Authorization: Bearer {tenant_access_token}
Content-Type: application/json

How to Get thread_id

A message in a topic group has a thread_id field. Retrieve it via:

GET https://open.feishu.cn/open-apis/im/v1/messages/{message_id}

The response data.items[0].thread_id contains the thread ID (e.g., omt_1accc5a75c0f9b93).

Script

Use scripts/forward_thread.py for the complete implementation.

python3 skills/feishu-thread-forward/scripts/forward_thread.py \
  --thread-id omt_xxxxx \
  --receive-id oc_xxxxx \
  --receive-id-type chat_id

Typical Flow

1. Get thread_id — from the message's metadata, or by calling GET message API
2. Call forward API — POST /im/v1/threads/{thread_id}/forward
3. Result — a merge_forward type message appears in the target chat as a clickable topic card

Forward vs Merge Forward vs Message Forward

Method	API	Result
Thread forward (this skill)	POST /threads/{thread_id}/forward	Topic card (clickable, shows thread context) ✅
Merge forward	POST /messages/merge_forward	"群聊会话记录" bundle (expandable message list)
Message forward	POST /messages/{message_id}/forward	Single message copied to target (loses thread context)

Thread forward is what users see when they click "转发话题" in Feishu client.

Prerequisites

• Bot must be in the source group (and can see the thread)
• Bot must be in the target group (or target user must be in bot's availability scope)
• Bot needs im:message or im:message:send_as_bot permission

Credentials

Read from /root/.openclaw/openclaw.json → channels.feishu.appId / channels.feishu.appSecret to obtain tenant_access_token.

Error Codes

Code	Meaning
230002	Bot not in target group
230013	Target user not in bot's availability scope
230064	Invalid thread_id
230066	Thread is in a secret group (no forwarding)
230070	Thread's group has anti-leak mode enabled
230073	Thread invisible to bot (joined after thread creation + history hidden)