v1.0.0

📄 Feishu Doc Manager | 飞书文档管理器

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:29 AM.

Analysis

The skill’s Feishu document purpose is coherent, but it asks users to install code from an external GitHub repo and use permissions that can change documents and collaborators.

GuidanceReview the external GitHub code before installing, grant only the minimum Feishu permissions needed, and require manual confirmation before overwriting/deleting document content or changing collaborator permissions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

cd ~/.openclaw/workspace/skills; git clone https://github.com/Shuai-DaiDai/feishu-doc-manager.git

The reviewed package is instruction-only, but the setup step directs users to pull the runnable skill from an external repository that is not included in the supplied artifacts.

User impactInstalling from that repo could introduce code the registry scan did not review, potentially acting with the Feishu permissions the skill requests.

RecommendationInspect the GitHub repository before cloning, pin to a reviewed commit, and avoid granting Feishu permissions until the actual code is verified.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Add/remove collaborators; Update permission levels (view/edit/full_access); Update/delete specific blocks

The documented actions can change access controls and delete or modify document content, but the artifact does not define safety checks such as explicit user confirmation, document scoping, or rollback.

User impactAn agent using the skill could make persistent changes to Feishu documents or permissions if the user’s request is ambiguous or misunderstood.

RecommendationRequire explicit confirmation for delete, overwrite, and permission-change operations, and test first on non-sensitive documents.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Required Permissions: `docx:document`, `docx:document:write_only`, `docs:permission.member`

These Feishu scopes support document access/writes and permission-member management, which are high-impact authorities for a document-management skill.

User impactIf misused, the skill could alter Feishu documents or collaborator access beyond what the user intended.

RecommendationUse least-privilege Feishu app credentials, limit the accessible documents/workspace where possible, and review each collaborator or permission change before applying it.