feishuFindDoc

Find and download files from Feishu chat history by filename.

Security Scan

The skill's code and SKILL.md require Feishu credentials (FEISHU_APP_ID and FEISHU_APP_SECRET) and perform network/download actions that are consistent with its purpose, but the registry metadata does not declare those required environment variables — an incoherence that could lead to credential surprises or misuse.

Purpose & Capability

The skill's stated purpose (find & download files from Feishu chat) matches the implementation (uses @larksuiteoapi/node-sdk to list messages and download resources). However, the registry metadata declares no required environment variables or primary credential, while SKILL.md and index.js both require FEISHU_APP_ID and FEISHU_APP_SECRET. This mismatch is unexpected and reduces transparency about what secrets the skill needs.

Instruction Scope

SKILL.md directs running npm install and node index.js with chat and filename arguments and explicitly requires FEISHU_APP_ID/FEISHU_APP_SECRET. The runtime instructions and code operate within the stated scope (search chat history, locate file messages, download file to disk). The instructions do not request unrelated files, system config, or external endpoints beyond Feishu's API (via the official SDK).

Install Mechanism

There is no custom install spec; the skill is instruction+code that expects a normal npm install of declared dependencies (commander and @larksuiteoapi/node-sdk). No arbitrary URL downloads or extract steps are used. Risk is typical for npm packages (supply-chain risk) but not unusual or disproportionate for this functionality.

Credentials

The credentials the code requires (FEISHU_APP_ID and FEISHU_APP_SECRET) are reasonable for accessing Feishu chat and downloading files — so their existence is proportionate. The issue is that the registry metadata did not advertise these required environment variables or a primary credential, meaning a user installing the skill might not realize they must provide secrets. That mismatch is a transparency and safety concern.

Persistence & Privilege

The skill does not request always: true, does not declare any system-wide config paths, and does not modify other skills. It writes downloaded files to a user-specified output directory (default current directory), which is expected behavior for a downloader.

What to consider before installing

This skill's behavior (using the Feishu SDK to search chat history and download files) is coherent with its description, but there is an important metadata mismatch: the registry entry does not declare the FEISHU_APP_ID and FEISHU_APP_SECRET env vars that both SKILL.md and the code require. Before installing or running this skill: 1) Only provide FEISHU_APP_ID/FEISHU_APP_SECRET for an app you created or trust; prefer an app with minimal permissions (read-only access to the specific chat scope). 2) Review package.json and the exact versions of dependencies (npm install will pull @larksuiteoapi/node-sdk and commander). 3) Run the skill in a sandboxed environment or container to limit filesystem/network exposure; it will write downloaded files to disk. 4) Ask the publisher to update registry metadata to declare the required environment variables and to provide a homepage/source repo for auditing. 5) If you need higher assurance, audit the SKILL.md and index.js yourself or have a trusted reviewer confirm there are no unexpected network endpoints or credential exfiltration paths (none were detected in the provided code).

Feishu File Finder

A utility skill to search for a file in a Feishu chat (by filename) and download it. Useful when OpenClaw's auto-download misses a file or for retrieving past files.

Prerequisites

• FEISHU_APP_ID and FEISHU_APP_SECRET must be set in environment.

Usage

cd skills/feishu-file-finder
npm install

# Basic usage
node index.js --chat <chat_id> --file <filename>

# Options
# -o, --output <dir>   Save path (default: current dir)
# -h, --hours <num>    Search history lookback (default: 24h)

Example

export FEISHU_APP_ID=...
export FEISHU_APP_SECRET=...

node index.js --chat oc_87435... --file travel-planner.zip