Feishu Group Mention Responder

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for replying to Feishu mentions, but users should notice it needs Feishu chat read/send authority and can automatically post bot replies.

Before installing, confirm the Feishu bot should be allowed to read relevant chat events and send replies as the bot. Configure it only for intended groups or direct-message contexts and verify mention detection to avoid unwanted or repeated messages.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If enabled, the bot can automatically post replies in Feishu groups or direct messages when it believes it was mentioned.

Why it was flagged

The skill instructs the agent to use a messaging tool to send replies into Feishu chats. This is purpose-aligned, but it is an action that affects other chat participants.

Skill content
使用 `message` 工具将回复消息发送回原始群聊
Recommendation

Limit the bot to intended chats, test mention detection, and keep the no-duplicate/no-loop safeguards in place.

What this means

The Feishu bot may be able to read chat events and send messages wherever those permissions are granted.

Why it was flagged

The skill discloses that the Feishu app needs permissions to read chats and send messages as the bot. These permissions are expected for the stated function, but they are still account/workspace privileges.

Skill content
确保飞书应用拥有 `im:message:send_as_bot` 和 `im:chat:read` 权限
Recommendation

Grant the minimum Feishu scopes and chat access needed, and ensure any Feishu credentials or app configuration are managed outside the skill in a controlled way.