ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Feishu Comments

v1.2.0

Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum...

⭐ 0· 460·0 current·0 all-time
bydeadblue@deadblue22

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for deadblue22/feishu-comments.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Feishu Comments" (deadblue22/feishu-comments) from ClawHub.
Skill page: https://clawhub.ai/deadblue22/feishu-comments
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install deadblue22/feishu-comments

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-comments
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
Name/description (fetching and resolving Feishu doc comments) aligns with the included scripts which call Feishu/Lark APIs and use appId/appSecret. However the skill metadata did not declare the need for Feishu credentials or system binaries, so the declared requirements do not fully reflect what the skill actually needs.
!
Instruction Scope
SKILL.md and the scripts explicitly instruct the agent to read ~/.openclaw/openclaw.json for appId/appSecret and domain, obtain a tenant_access_token, and call Feishu drive/docx APIs. Reading a user-local config file in the home directory is outside what the registry metadata declared and could expose other local configuration if the file contents differ from expectations.
✓
Install Mechanism
No install spec — instruction-only with bundled scripts. No remote downloads or package installs are present, which keeps install risk low.
!
Credentials
The scripts require Feishu app credentials (appId/appSecret) and system binaries (curl, python3) but the skill metadata lists no required env vars or binaries. The missing declaration is a proportionality / transparency problem: the skill legitimately needs Feishu credentials for its purpose, but that need should be declared so users understand what they must provide and what will be accessed.
✓
Persistence & Privilege
always is false and the skill does not request system-wide persistence or modify other skills' configs. It performs API calls and (optionally) patches comments via Feishu APIs, which is within its stated scope.
What to consider before installing
Before installing: review the two bundled scripts (get_comments.sh and resolve_comments.sh). They read your OpenClaw config at ~/.openclaw/openclaw.json to extract appId/appSecret and may call Feishu/Lark APIs to list or close comments. Confirm that you trust the skill owner and that ~/.openclaw/openclaw.json contains only the expected Feishu channel credentials. Be aware the resolve script will modify comments (auto-resolve orphaned or specified comment IDs) — test in a safe document or with a limited-permission Feishu app first. The registry metadata should have declared these requirements (credentials and curl/python3); the omission is likely an oversight but is a transparency risk. If you need higher assurance, request the author to (1) declare required credentials/binaries in metadata, (2) document exactly what is read from the config file, or (3) offer an option to pass credentials via a dedicated, minimal config or environment variables rather than reading your home config.

Like a lobster shell, security has layers — review code before you run it.

latestvk975kjs9f1cc0e8pztjw6thazn82n1dd
460downloads
0stars
4versions
Updated 17h ago
v1.2.0
MIT-0
deadblue@deadblue22
latest
Download

Feishu Document Comments

Fetch comments from Feishu docx documents via the Drive Comment API.

Requirements

  • Feishu app credentials configured in ~/.openclaw/openclaw.json (reads appId and appSecret from channels.feishu)
  • System dependencies: curl, python3 (must be available on PATH)
  • Feishu app permission: docs:document.comment:read or drive:drive

Usage

Run the bundled script to get all comments on a document:

bash skills/feishu-comments/scripts/get_comments.sh <doc_token>

To fetch specific comments by ID:

bash skills/feishu-comments/scripts/get_comments.sh <doc_token> "id1,id2,id3"

Resolve skills/ paths relative to the workspace directory.

When to Use

  • After feishu_doc list_blocks shows comment_ids on blocks
  • When user asks to review or check comments on a document
  • During document collaboration review cycles

Output Format

Each comment shows:

  • Comment ID, status (Open/Resolved), scope (Global/Local)
  • Quoted text (for local/inline comments)
  • All replies with user ID and text content

Extracting doc_token

From URL https://xxx.feishu.cn/docx/ABC123def → doc_token = ABC123def

For wiki pages, first use feishu_wiki to get obj_token, then use that as the doc_token.

How It Works

The bundled shell script:

  1. Reads Feishu app credentials (appId, appSecret) from ~/.openclaw/openclaw.json
  2. Obtains a tenant_access_token via the Feishu auth API
  3. Calls the Drive Comment API to list and batch-query comments
  4. Formats and outputs comment content to stdout

No data is sent to any third party beyond the Feishu/Lark API endpoints.

Limitations

  • Read-only (cannot create or reply to comments)
  • API error responses are printed to stderr (may contain request IDs but no sensitive data)

Comments

Loading comments...