v1.0.0

feishui-file-sender

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:03 AM.

Analysis

This is a simple instruction-only Feishu file-sending helper; its main caution is to verify the file path and chat target before sending local files externally.

GuidanceThis skill appears coherent and purpose-aligned. Use it only when you intentionally want to send a specific local file or archive to Feishu, and double-check the archive contents, absolute file path, and target chat ID before sending.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

message( action="send", channel="feishu", filePath="/tmp/skill_name.zip", message="📦 Skill Name", target="oc_xxxxxxxxxxxx" )

The skill instructs use of a messaging tool to send a local file path to a Feishu chat. This is the stated purpose, but it is still an external file-transfer action that should be directed by the user.

User impactA wrong file path or chat ID could send a local file to the wrong Feishu group or user.

RecommendationBefore using it, confirm the exact file path, archive contents, and Feishu recipient.

Unexpected Code Execution

SeverityInfoConfidenceHighStatusNote

SKILL.md

cd /root/.openclaw/workspace/skills
zip -r /tmp/skill_name.zip skill_folder/

The skill includes a shell command to create a ZIP archive from a local skill folder. This is purpose-aligned packaging, not hidden execution, but users should ensure the selected folder does not contain unintended private files.

User impactThe ZIP archive may include more files than intended if the wrong directory is selected.

RecommendationInspect or list the archive contents before sending, especially when packaging skill folders.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

- OpenClaw configured with Feishu channel
- Target chat ID (group or user)

The skill depends on an existing Feishu channel configuration and a chat target, meaning it uses delegated Feishu messaging access. This is expected for the purpose, but users should be aware which account/channel is being used.

User impactFiles may be sent under the configured Feishu identity to group chats or direct messages.

RecommendationUse only the intended Feishu account/channel and verify the target chat ID before sending.