feishu-card-sender-beautify 飞书推送展示卡片脚本

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill coherently documents sending Feishu interactive-card messages, but users should confirm recipients, content, schedules, and bot permissions.

Install only if you want an agent to help send Feishu card messages. Before use, verify the Feishu chat/user ID, message body, any button links, and any scheduled triggers, and keep the bot’s Feishu permissions limited to the intended recipients.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken recipient ID, recipient type, or card body could send an internal notification to the wrong Feishu chat or user.

Why it was flagged

The skill instructs the agent to use a Feishu messaging tool to send interactive cards to a specified chat; this matches the purpose but can publish to the wrong chat if misused.

Skill content
使用 `feishu_im_user_message` 工具 ... action="send", msg_type="interactive", receive_id="oc_群聊ID", receive_id_type="chat_id"
Recommendation

Confirm the recipient, recipient type, and message content before sending, and keep message sends tied to an explicit user request or reviewed workflow.

What this means

The connected Feishu bot may be able to send and receive messages wherever its granted permissions and memberships allow.

Why it was flagged

The documentation discloses that the Feishu app needs bot send and receive message permissions; this is expected for the integration but grants delegated workspace messaging authority.

Skill content
发送消息需要飞书应用具备以下权限:- `im.message.send_as_bot` - 发送消息 - `im.message.receive_as_bot` - 接收消息
Recommendation

Grant only the minimum Feishu permissions needed, restrict the bot to intended chats, and review who can trigger the skill.

What this means

If attached to a scheduler, the bot could send recurring Feishu notifications without a fresh manual prompt each time.

Why it was flagged

The skill names scheduled pushes as a trigger condition; the artifacts do not create persistence, but scheduled use could cause recurring message sends if configured elsewhere.

Skill content
触发条件:(1) 用户要求发送卡片消息 (2) 定时任务推送 (3) 格式化通知需求
Recommendation

Use only reviewed schedules, document who owns them, and define clear stop conditions for recurring notifications.