Enable Feishu to send files or images
AdvisoryAudited by Static analysis on Mar 10, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the configured Feishu app has broad permissions, the skill can use those permissions to upload files and send messages.
The skill intentionally reads local Feishu app credentials to obtain an access token. This is disclosed and purpose-aligned, but those credentials can authorize Feishu API actions.
读取 ~/.openclaw/openclaw.json 中的飞书应用凭据 (appId, appSecret)
Use a Feishu app credential with only the permissions needed for image/file upload and message sending, and keep ~/.openclaw/openclaw.json protected.
A wrong file path or recipient ID could send private local content to the wrong Feishu user or group.
The script uploads the user-specified local file to Feishu's API before sending it. The destination is disclosed and matches the skill purpose, but it is an external data transfer.
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" ... -F "file=@$FILE_PATH"
Confirm the exact file path and Feishu recipient before invoking the skill, especially for sensitive documents or images.
The agent can cause a Feishu message to be sent under the configured app's authority.
The script can send a Feishu message to any supplied receive_id/receive_id_type. This is the intended function, but it is a high-impact action if used with the wrong target.
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE"
Treat sends as final actions; verify recipient IDs and avoid letting the agent infer recipients for sensitive files.
Platform-level permission or setup prompts may not fully reflect the credential/config/tooling the skill needs.
Registry metadata under-declares runtime needs, while the supplied SKILL.md/script disclose reliance on ~/.openclaw/openclaw.json and tools such as curl/stat/sips.
Required binaries (all must exist): none; Required env vars: none; Primary credential: none; Required config paths: none
The publisher should declare the Feishu credential/config path and required binaries in metadata; users should review SKILL.md before use.