Feishu Auto Reply

Feishu Auto Reply Bot - Automatic reply to Feishu messages based on rules

Security Scan

This package is internally consistent with an auto-reply Feishu CLI: it implements rule testing and config generation, requests no unrelated secrets, and contains no obvious exfiltration or surprising install behavior — though the live event/subscription integration is not implemented and you should supply Feishu credentials via your platform when enabling real auto-replies.

Purpose & Capability

Name, description, README, SKILL.md and index.js align: the skill is a CLI tool to test rules and (in future) run an auto-reply service for Feishu. The code implements rule matching, working hours, and config generation as described. The 'start' command is a placeholder that states event subscription is not yet implemented.

Instruction Scope

SKILL.md and README only instruct running the CLI and editing a local YAML config; they do not instruct reading unrelated files or environment variables. However, the docs mention required Feishu permissions (im:message:read/send, im:chat:read) but provide no guidance in the skill for where or how to supply Feishu credentials or webhook info — likely expecting the platform (OpenClaw) to handle event delivery/credentials. The 'start' command currently does not connect to Feishu, so actual message handling is not implemented in this version.

Install Mechanism

No install spec in registry (instruction-only), and included package.json only depends on common npm packages (commander, yaml). package-lock references npm mirror registry URLs — typical for npm installs. No remote download or archive extraction from untrusted URLs is present.

Credentials

The skill declares no required environment variables or credentials in metadata and the code does not read secrets. The README lists Feishu API permissions that are appropriate for an auto-reply bot, but there is no code or docs showing how credentials (app id/secret, webhook, or token) are provided — this is reasonable if the hosting platform supplies credentials, but you should verify how OpenClaw will provide Feishu auth before enabling the skill.

Persistence & Privilege

Flags are default (always:false, user-invocable:true). The skill does not request persistent system changes or modify other skills' configuration. It does not autonomously persist credentials or enable itself.

Assessment

This skill appears to be what it claims: a local CLI to test and (eventually) run Feishu auto-replies. Before installing/activating it: 1) test rules locally with the provided test command and example config; 2) confirm how your OpenClaw environment supplies Feishu credentials or event subscriptions (the start command is a placeholder and the skill doesn't itself implement authentication); 3) only grant the listed Feishu permissions (im:message:read, im:message:send, im:chat:read) to a dedicated bot account; 4) run in a test group first to avoid accidental mass replies; and 5) review any future changes that add network calls or credential handling to ensure they are limited to the Feishu API endpoints you expect.

Feishu Auto Reply Bot

Automatic reply to Feishu messages based on custom rules, features:

• Keyword matching support
• Regular expression matching
• Multiple reply strategies
• Support for @mention only reply
• Working hours configuration
• Custom reply templates
• Support for rich text messages

Usage

# Start auto reply service
openclaw feishu-auto-reply start --config ./config.yaml

# Test rule matching
openclaw feishu-auto-reply test --message "你好" --config ./config.yaml

Configuration Example (config.yaml)

rules:
  - keyword: "你好"
    reply: "你好！我是自动回复机器人，有什么可以帮你的？"
    match: contains
  - regex: "^(请假|休假)"
    reply: "请假请直接联系人事部门，谢谢！"
    only_mention: true
working_hours:
  - "9:00-18:00"
  - exclude_weekends: true

Required Permissions

• im:message:read
• im:message:send
• im:chat:read