Feishu Advanced Builder

Key points before you install/use this skill: - Origin verification: The skill's Source/Homepage are unknown. Only install if you trust the publisher or can host/inspect the code yourself. - Credentials: The scripts require FEISHU_APP_ID and FEISHU_APP_SECRET even though registry metadata didn't declare them — do not provide tenant-wide admin credentials unless you understand scope. Prefer creating an app with minimal write scopes and test in a non-production tenant. - Dependency & runtime: The bundled Node scripts reference 'feishu-markdown' and rely on fetch being available. The skill provides no install instructions; you'll likely need to install npm packages manually. Review and vendor dependencies before running to avoid pulling malicious packages. - Token leakage: The scripts log tokens and API responses to stdout. Ensure logs are not sent to external log aggregators or shared channels, or modify the code to avoid printing tokens. - File access: The tools accept arbitrary local file paths (markdown, code). Only run them with files you intend to expose and avoid running them with elevated privileges or in directories containing secrets. - Recommended actions: If you want to use this, fetch the repository, review the three scripts and their dependencies, run them in an isolated environment (ephemeral container) with a least-privilege Feishu app, and consider adding explicit documentation or an install script that pins dependencies and documents the exact env vars used (including FEISHU_BASE_URL). If you cannot validate the source, treat it as untrusted code and do not provide production credentials.