Feishu File Sender

Send local files to Feishu chats. Supports uploading and sending any file type as a Feishu file message.

Security Scan

The skill's code, declared requirements, and runtime instructions align with its stated purpose of uploading and sending local files to Feishu; nothing requested appears unrelated or excessive.

Purpose & Capability

Name/description, required binaries (curl, jq), required env vars (FEISHU_APP_ID, FEISHU_APP_SECRET), and the included script all match the stated goal of uploading a file to Feishu and sending it as a message.

Instruction Scope

SKILL.md and scripts/send_file.sh only read the provided local file and the declared environment variables, and they call Feishu's documented endpoints (open.feishu.cn) for auth, upload, and message sending. There is no attempt to read other system files or unrelated environment variables.

Install Mechanism

No install spec (instruction-only with a bundled script). Nothing is downloaded from external/untrusted URLs and no archives are extracted; risk from install mechanism is minimal.

Credentials

Only FEISHU_APP_ID and FEISHU_APP_SECRET are required (plus an optional FEISHU_RECEIVER). These are the expected credentials for a Feishu app and are proportionate to the functionality.

Persistence & Privilege

Skill is not marked always:true, does not request system-wide changes, and does not modify other skills' configs. Autonomous invocation is the platform default and not a separate concern here.

Assessment

This skill appears to do exactly what it says: it uploads a local file and sends it to a Feishu receiver using the FEISHU_APP_ID and FEISHU_APP_SECRET you provide. Before installing or running: (1) review the script (scripts/send_file.sh) yourself — it will read whatever local file path you pass and send it to the specified receiver; avoid sending sensitive files accidentally. (2) Ensure the Feishu app has the listed permissions (im:message, im:message:send_as_bot, im:resource). (3) Store FEISHU_APP_SECRET securely; the script will print API responses on error (which could reveal tokens or error details) — remove or limit debug prints if that is a concern. (4) As with any third-party script, run it in a controlled environment first if you are unsure of its provenance.

A skill to send local files to Feishu users or groups.

Setup

Requires Feishu App credentials. Ensure these are set in your environment or openclaw.json:

export FEISHU_APP_ID="cli_xxx"
export FEISHU_APP_SECRET="xxx"
export FEISHU_RECEIVER="ou_xxx" # Default receiver (optional)

Usage

Basic Usage

Send a file to the default receiver (configured in FEISHU_RECEIVER):

bash scripts/send_file.sh "/path/to/your/file.pdf"

Specific Receiver

Send to a specific OpenID:

bash scripts/send_file.sh "/path/to/report.xlsx" "ou_abcdef123456"

Different Receiver Types

Send to a Group (chat_id):

bash scripts/send_file.sh "/path/to/archive.zip" "oc_abcdef123456" "chat_id"

Supported types: open_id, user_id, chat_id, email.

Script Details

scripts/send_file.sh

The main script that handles the 3-step process:

1. Auth: Obtains a tenant_access_token.
2. Upload: Uploads the file to Feishu's internal storage using POST /im/v1/files.
3. Send: Sends the file message using POST /im/v1/messages.

Permissions Required

The Feishu App must have the following permissions:

• im:message (Send and receive messages)
• im:message:send_as_bot (Send messages as bot)
• im:resource (Access and upload resources)