Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Feishu IM Read

v1.0.0

飞书 IM 消息读取工具使用指南,覆盖会话消息获取、话题回复读取、跨会话消息搜索、图片/文件资源下载。 **当以下情况时使用此 Skill**: (1) 需要获取群聊或单聊的历史消息 (2) 需要读取话题(thread)内的回复消息 (3) 需要跨会话搜索消息(按关键词、发送者、时间等条件) (4) 消息中包含图...

0· 64·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for a3152557994-ship-it/feishu-im-read.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Feishu IM Read" (a3152557994-ship-it/feishu-im-read) from ClawHub.
Skill page: https://clawhub.ai/a3152557994-ship-it/feishu-im-read
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feishu-im-read

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-im-read
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The Skill's purpose is to read Feishu IM messages and download resources, which requires user-level credentials (OAuth tokens or platform-provided user context). However, the skill declares no required environment variables, no primary credential, and no install steps. The SKILL.md even references OAuth/authorization in troubleshooting, so the lack of any declared credential or explanation of how feishu_im_user_* calls are authorized is a substantive mismatch.
Instruction Scope
The SKILL.md stays within the stated purpose (get messages, search, fetch resources) and provides detailed parameter guidance. However, it explicitly recommends proactively expanding any discovered thread_id to fetch up to 10 replies (and optionally all replies), and it supports cross-conversation searches across 'all conversations'. Those behaviors can significantly widen the scope of data accessed beyond the user's immediate request and should be gated by explicit user consent. The instructions do not define any consent-check or explicit confirmation step before broad searches or thread expansions.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes filesystem/execution risk because nothing is downloaded or installed by the skill package itself.
!
Credentials
The Skill requests access to potentially sensitive user data but lists no required environment variables, tokens, or primary credential. This is disproportionate: reading messages and downloading resources requires authenticated access to Feishu. The SKILL.md references OAuth authorization in troubleshooting, but the skill metadata does not declare how credentials are supplied or what scope is needed, making it unclear what secrets or tokens will be accessed or required at runtime.
Persistence & Privilege
The skill does not request permanent presence (always: false) and contains no install-time behavior that would modify agent/system configuration. It does not ask to persist credentials or modify other skills' settings in the provided content.
What to consider before installing
This skill appears to be a usage guide for Feishu message-reading functions, but it does not say how it obtains the necessary authentication to access a user's Feishu messages. Before installing or enabling it, confirm the following with the skill author or platform: (1) how feishu_im_user_get_messages / feishu_im_user_fetch_resource are authorized — does the platform supply ephemeral user tokens or does the skill expect you to provide an OAuth token or API key? (2) what exact OAuth scopes are required and where tokens are stored/used; avoid giving long-lived credentials unless you trust the implementation. Also be aware the instructions recommend proactively expanding thread replies and running cross-conversation searches, which can read a lot more messages than a narrow user request — require explicit user consent before broad searches or auto-expanding threads. If the platform cannot explain how credentials are handled (or if the skill would require you to paste credentials into its config), do not install it. If you proceed, limit scopes, prefer short-lived tokens, and test with non-sensitive accounts first.

Like a lobster shell, security has layers — review code before you run it.

latestvk9747326nnmn96vxh0j8vfxpex85ejvq
64downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

飞书 IM 消息读取

执行前必读

  • 该 Skill 中的所有消息读取工具均以用户身份调用,只能读取用户有权限的会话
  • feishu_im_user_get_messagesopen_idchat_id 必须二选一
  • 消息中出现 thread_id 时,根据用户意图判断是否用 feishu_im_user_get_thread_messages 读取话题内回复
  • 以用户身份读取后,如果消息内容中出现资源标记时,用 feishu_im_user_fetch_resource 下载,需要 message_id + file_key + type

快速索引:意图 → 工具

用户意图工具必填参数常用可选
获取群聊/单聊历史消息feishu_im_user_get_messageschat_id 或 open_id(二选一)relative_time, start_time/end_time, page_size, sort_rule
获取话题内回复消息feishu_im_user_get_thread_messagesthread_id(omt_xxx)page_size, sort_rule
跨会话搜索消息feishu_im_user_search_messages至少一个过滤条件query, sender_ids, chat_id, relative_time, start_time/end_time, page_size
下载消息中的图片feishu_im_user_fetch_resourcemessage_id, file_key(img_xxx), type="image"-
下载消息中的文件/音频/视频feishu_im_user_fetch_resourcemessage_id, file_key(file_xxx), type="file"-

核心约束

1. 时间范围:确保消息覆盖完整

当用户没有明确指定时间范围时,根据用户意图推断合适的 relative_time,确保返回的消息能完整覆盖用户关心的内容。用户明确指定时间时直接使用用户的值。

2. 分页:根据需要翻页获取更多结果

  • page_size 范围 1-50,默认 50
  • 返回结果中 has_more=true 时,可使用 page_token 继续获取下一页
  • 根据用户需求判断是否需要翻页:需要完整结果时继续翻页,浏览概览时第一页通常够用

3. 话题回复:主动展开话题获取上下文

获取历史消息时,返回的消息中如果包含 thread_id 字段,推荐主动获取话题的最新 10 条回复(page_size: 10, sort_rule: "create_time_desc")以提供更完整的上下文。

场景行为
获取历史消息并需要理解上下文(默认)对发现的 thread_id 调用 feishu_im_user_get_thread_messages 获取最新 10 条回复
用户要求"完整对话"、"详细讨论"、"看看回复"获取话题全部回复(page_size: 50, sort_rule: "create_time_asc"),需要时翻页
用户只浏览消息概览 / 用户明确说不看回复跳过话题展开

注意:话题消息不支持时间过滤(飞书 API 限制),只能通过分页获取。

4. 跨会话消息搜索

feishu_im_user_search_messages 支持跨所有会话搜索消息:

参数说明
query搜索关键词,匹配消息内容
sender_ids发送者 open_id 列表
chat_id限定搜索范围的会话 ID
mention_ids被@用户的 open_id 列表
message_type消息类型:file / image / media
sender_type发送者类型:user / bot / all(默认 user)
chat_type会话类型:group / p2p

搜索结果每条消息额外包含 chat_idchat_type(p2p/group)、chat_name。单聊消息还有 chat_partner(对方 open_id 和名字)。

5. 图片/文件/媒体资源的提取

消息内容中可能出现以下资源标记,用 feishu_im_user_fetch_resource 下载:

资源类型内容中的标记格式fetch_resource 参数
图片![image](img_xxx)message_id=om_xxx, file_key=img_xxx, type="image"
文件<file key="file_xxx" .../>message_id=om_xxx, file_key=file_xxx, type="file"
音频<audio key="file_xxx" .../>message_id=om_xxx, file_key=file_xxx, type="file"
视频<video key="file_xxx" .../>message_id=om_xxx, file_key=file_xxx, type="file"

从消息的 message_id 字段和内容中的 file_key 组合即可调用 fetch_resource。

注意:文件大小限制 100MB,不支持下载表情包、卡片中的资源。

6. 时间过滤

feishu_im_user_get_messagesfeishu_im_user_search_messages 支持时间过滤,话题消息不支持。

方式参数示例
相对时间relative_timetodayyesterdaythis_weeklast_3_dayslast_24_hours
精确时间start_time + end_timeISO 8601 格式:2026-02-27T00:00:00+08:00
  • relative_timestart_time/end_time 互斥,不能同时使用
  • 可用的 relative_time 值:todayyesterdayday_before_yesterdaythis_weeklast_weekthis_monthlast_monthlast_{N}_{unit}(unit: minutes/hours/days)

7. open_id 与 chat_id 的选择

参数格式适用场景
chat_idoc_xxx已知会话 ID(群聊或单聊均可)
open_idou_xxx已知用户 ID,获取与该用户的单聊消息(自动解析为 chat_id)

两者必须二选一,优先使用 chat_id


使用场景示例

场景 1: 获取群聊消息并展开话题

步骤 1:获取群聊消息

{ "chat_id": "oc_xxx" }

步骤 2:返回的消息中发现 thread_id,展开话题最新回复:

{ "thread_id": "omt_xxx", "page_size": 10, "sort_rule": "create_time_desc" }

场景 2: 跨会话搜索消息

{ "query": "项目进度", "chat_id": "oc_xxx" }

场景 3: 分页获取更多消息

第一次调用返回 has_more: truepage_token: "xxx",继续获取:

{ "chat_id": "oc_xxx", "page_token": "xxx" }

场景 4: 下载消息中的资源

{ "message_id": "om_xxx", "file_key": "img_v3_xxx", "type": "image" }

常见错误与排查

错误现象根本原因解决方案
消息结果太少时间范围太窄或未传时间参数根据用户意图推断合适的 relative_time
消息不完整没有检查 has_more 并翻页has_more=true 时用 page_token 翻页
话题讨论内容不完整没有展开 thread_id发现 thread_id 时获取话题回复
"open_id 和 chat_id 不能同时提供"同时传了两个参数只传其中一个
"relative_time 和 start_time/end_time 不能同时使用"时间参数冲突选择一种时间过滤方式
"未找到与 open_id=xxx 的单聊会话"没有单聊记录改用 chat_id,或确认存在单聊
话题消息返回为空thread_id 格式不正确确认为 omt_xxx 格式
图片/文件下载失败file_key 或 message_id 不匹配确认 file_key 来自该 message_id
权限不足用户未授权或无权限确认已完成 OAuth 授权且是会话成员

Comments

Loading comments...