feishu-agents

绑定飞书机器人到Agent。用户发送App ID和App Secret即可自动配置飞书账号并绑定到指定Agent。用于：(1) 用户提供App ID和App Secret (2) 创建或选择要绑定的Agent (3) 自动配置openclaw.json并重启Gateway。

Security Scan

The skill's instructions, scope, and lack of extra requirements align with its stated purpose (binding a Feishu bot to an Agent), but it will collect and store sensitive App Secret values and perform config and gateway restarts — handle with care.

Purpose & Capability

Name/description match the actions in SKILL.md: collecting App ID/App Secret, creating/selecting an Agent, writing channels.feishu.* config keys, binding the agent, and restarting the gateway. No unrelated permissions, binaries, or external services are requested.

Instruction Scope

Instructions are narrowly scoped to openclaw CLI operations (agents add/list/bind, config set, gateway restart, channels status). They do require collecting sensitive credentials (App Secret) and writing them into openclaw.json via CLI, but they do not instruct the agent to read unrelated system files or exfiltrate data to external endpoints.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is downloaded or written by the skill itself. This is the lowest-risk install posture.

Credentials

No environment variables or external credentials are declared, which is consistent. The skill does ask the user to provide an App Secret (expected for this task). Risk: the guidance implies storing App Secret in openclaw.json (likely plaintext) — that is sensitivity-proportional but carries storage/exposure concerns that the SKILL.md does not address.

Persistence & Privilege

The workflow modifies agent configuration (openclaw.json) and restarts the Gateway — both are privileged, system-impacting operations. The skill is not marked always:true, but because model-invocation is enabled by default, an agent could autonomously run these CLI commands if invoked. The actions are coherent with the purpose but are high-impact and warrant explicit user confirmation and safe handling of secrets/backups.

Assessment

This skill appears to do what it says: it asks for an App ID and App Secret and runs openclaw CLI commands to add the account, set config keys, bind the Agent, and restart the Gateway. Before installing or using it: (1) be aware you will give it an App Secret — treat that as sensitive and only provide it in a secure session; (2) back up openclaw.json before making changes, and verify how/openclaw stores secrets (it may be plaintext); (3) confirm the agent will prompt you for explicit confirmation before running CLI commands that change config or restart services (to avoid accidental/autonomous execution); (4) rotate the App Secret after testing if you are unsure about storage; (5) ensure the Feishu app has only the minimal permissions required. If you need the skill to be stricter, request that it explicitly ask for confirmation before making changes and that it documents where credentials are stored.

飞书 Agent 绑定

用户发送 App ID 和 App Secret 时，使用此 skill 自动完成飞书机器人绑定。

触发条件

• 用户发送 cli_ 开头的 App ID
• 用户发送飞书机器人凭证

绑定流程

1. 收集信息

需要用户提供：

• App ID: 飞书应用 ID (cli_xxx)
• App Secret: 飞书应用密钥
• Agent名称: 要绑定的 Agent ID (如 news, assistant 等)

如果用户只提供 App ID 和 App Secret，询问要绑定到哪个 Agent，或自动创建一个新 Agent。

2. 创建 Agent (如需要)

# 创建新 Agent
openclaw agents add <agentName>

# 示例：创建 news agent
openclaw agents add news

3. 执行绑定

# 查看现有 Agent 列表
openclaw agents list

# 添加飞书账号到配置
openclaw config set "channels.feishu.accounts.<agentName>.appId" "<App ID>"
openclaw config set "channels.feishu.accounts.<agentName>.appSecret" "<App Secret>"

# 绑定 Agent 到飞书账号
openclaw agents bind --agent <agentName> --bind feishu:<agentName>

3. 重启 Gateway

openclaw gateway restart

4. 验证

openclaw channels status

注意事项

• 如果是首次配置，需要确保飞书应用已在开放平台发布并具备必要权限：
  • im:message:send_as_bot
  • im:message:receive
  • contact:contact.base:readonly
• 配置完成后告知用户如何获取 user open_id 以配置白名单