feishu-chatfile-skill

This skill implements Feishu two-step upload->send and the scripts look legitimate for that purpose, but there are some red flags you should consider before enabling it: - The SKILL.md tells the agent to read /root/.openclaw/openclaw.json to extract app_id/app_secret, but the skill metadata does not declare any required credentials. That means the skill will access agent configuration to obtain secrets without having made that need explicit. - The scripts use curl (via subprocess) and require python3; the registry entry doesn't list these dependencies. Ensure your runtime provides these binaries if you plan to use it. - The skill can send arbitrary local files/images to Feishu using the app credentials it obtains. If the agent is allowed to run autonomously, this capability could be used to exfiltrate sensitive files. Consider whether you trust the agent and the Feishu destination IDs it will use. Recommendations: - Only enable this skill if you trust the skill source and the Feishu app owner. Prefer to supply explicit, scoped credentials rather than letting the skill read agent-wide config. - Restrict which files the agent may send (e.g., sandbox generated outputs only) and audit sent message logs. - If you need stronger control, disable autonomous invocation for the agent or require explicit user confirmation before sending files. - Ask the publisher to update metadata to declare required credentials and binaries, and to remove or clarify the mandated automatic-send rule if undesired.