Feishu Upload Skill

What to check before installing: - Credentials: get_feishu_token.sh contains a hard-coded APP_ID and APP_SECRET. Treat those as sensitive: do not assume they are safe to use. Either replace them with your own app credentials, or remove the script and supply your own tenant_access_token. If those credentials were used in a shared/demo package, rotate them in Feishu immediately. - Metadata mismatch: the registry metadata claims no required config/env, but the code reads /home/node/.openclaw/openclaw.json and stores/reads /home/node/.openclaw/workspace/feishu_token.txt. Expect the skill to create and read token files in the OpenClaw workspace. - Inspect and run in a sandbox: run install and first runs in an isolated environment (or container) so you can see token creation and network calls. The endpoints contacted are legitimate Feishu endpoints (open.feishu.cn), but you should still control which App ID/Secret are used. - Dependencies & runtime: native scripts target Node.js ≥18. Some scripts (simple_feishu_upload.js) require the npm package 'form-data' though package.json declares no dependencies—install missing packages or prefer native native_feishu_upload.js on Node 18+. get_feishu_token.sh uses python3 for JSON parsing; ensure python3 exists. - Audit outputs: the skill saves tokens and upload_result.json in the workspace. Ensure those files are stored with appropriate permissions and rotated/removed if they contain sensitive tokens. - Recommended actions: (1) open and remove/replace embedded APP_SECRET with your own or change get_feishu_token.sh to read credentials from a secure location (env vars or a secrets manager); (2) declare required config paths/env in your OpenClaw deployment; (3) run the tool manually first to verify behavior; (4) if you do not trust the source, do not run get_feishu_token.sh — instead obtain a token via your own secure process. Overall: the code implements the advertised feature and uses legitimate Feishu APIs, but the presence of embedded credentials and the metadata/config mismatches are red flags — treat this as suspicious until credentials and config handling are fixed or explicitly approved.