Feishu Media Delivery

Reliably deliver generated images and videos to Feishu/Lark users and chats. Use when an agent already has a local image/video result and must send it to Fei...

Security Scan

The skill's code and instructions match its stated purpose (sending images/videos to Feishu) and the required secrets are proportional, but the registry metadata omits the environment variables the scripts actually need and there is no install spec — these packaging issues should be checked before use.

Purpose & Capability

The name/description describe exactly what the scripts do: upload images/media and send Feishu messages. The included code uses the official @larksuiteoapi/node-sdk and reads local media files to upload — this is proportional to the purpose. However, registry metadata lists no required env vars while SKILL.md and the scripts require FEISHU_APP_ID and a FEISHU_APP_SECRET_PATH (or default secret file). That metadata omission is an incoherence in packaging.

Instruction Scope

SKILL.md instructs the agent to run the included node scripts with a target receive_id and local file path. The scripts read a local secret file and the specified media file, call Feishu APIs via the SDK, and print Feishu responses. They do not reference unrelated system paths, contact external endpoints beyond Feishu (via the SDK), nor attempt to collect or transmit other local data. They require explicit file path arguments, so accidental broad data access is limited to what the caller passes.

Install Mechanism

There is no install spec although a package.json and package-lock.json are included. Dependencies are normal (npm registry, @larksuiteoapi/node-sdk). This is not dangerous, but users must run npm install (and have Node) to run the scripts; the package metadata should ideally declare this. No downloads from unknown/personal URLs are present.

Credentials

The scripts legitimately need FEISHU_APP_ID and the app secret (via FEISHU_APP_SECRET_PATH or a default file). That scope is proportional to sending messages on behalf of a Feishu app. The incoherence: the skill registry metadata lists no required environment variables or primary credential, which understates the secret access the scripts need. The secret is read from a filesystem path, so the secret file's location and permissions matter.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide settings, and does not persist new credentials or enable itself. It only reads a secret file and local media files at runtime.

Assessment

This skill appears to do exactly what it claims (upload local images/videos and send Feishu messages) and uses the official Feishu Node SDK. Before installing or running it, verify: 1) You have a trusted FEISHU_APP_ID and a securely stored app secret file (the script defaults to ~/.openclaw/secrets/feishu_app_secret or FEISHU_APP_SECRET_PATH). Ensure the secret file permissions are tight. 2) The registry metadata omission: the skill should declare required env vars — treat that as a packaging bug and confirm the required variables before enabling automated invocation. 3) Run npm install in the scripts folder in a controlled environment and perform an npm audit on dependencies. 4) Because the scripts will read any file path you pass, ensure the agent or caller cannot be tricked into sending sensitive local files to Feishu. If you need stronger assurance, ask the publisher for a homepage/source repo or a signed release; absence of a homepage reduces provenance confidence.

Use this skill as the last-mile delivery layer for multimodal agents.

It does not generate content. It only makes sure already-generated files are sent to Feishu with the correct protocol.

What this skill is for

Use this skill when you already have a generated result and need to deliver it to a Feishu user/chat.

Typical cases:

• A generated jpg/png must be sent as a real Feishu image message
• A generated mp4 must be sent as a real Feishu media message
• A multimodal agent finished generation and now needs reliable delivery
• You want to avoid protocol mistakes like sending jpg/mp4 as the wrong message type

Hard rules

Images

For images, do not send the local file as plain text or guess a generic attachment format.

Correct flow:

1. Upload image to Feishu IM resource API
2. Get image_key
3. Send message with msg_type=image

Use:

• scripts/send-image.mjs

Videos

For mp4 videos, do not send them as file messages.

Correct flow:

1. Upload mp4 to Feishu IM file API
2. Get file_key
3. Send message with msg_type=media

Use:

• scripts/send-media.mjs

Required environment

The scripts expect:

• FEISHU_APP_ID
• FEISHU_APP_SECRET_PATH or default secret file at ~/.openclaw/secrets/feishu_app_secret

Default secret path:

• ~/.openclaw/secrets/feishu_app_secret

Receive ID assumptions

The bundled scripts default to receive_id_type=open_id.

Use them directly when the target is a Feishu user open_id like:

• ou_xxx

If you need group delivery later, extend the script to accept chat_id and switch receive_id_type.

Commands

Send image to a Feishu user

cd scripts
node send-image.mjs <open_id> /path/to/image.jpg

Example:

cd scripts
node send-image.mjs ou_xxx /tmp/result.jpg

Send mp4 video to a Feishu user

cd scripts
node send-media.mjs <open_id> /path/to/video.mp4 mp4 5000

Arguments:

• arg1: target open_id
• arg2: local mp4 path
• arg3: file type, usually mp4
• arg4: duration in milliseconds, optional but recommended

Example:

cd scripts
node send-media.mjs ou_xxx /tmp/result.mp4 mp4 5000

Output expectations

A successful send should return Feishu success payloads such as:

• code: 0
• msg: success

Do not assume transport success only from local script execution. Check the returned Feishu response.

Fallback policy

Image fallback

If real Feishu image sending fails, report that image delivery failed. Do not silently pretend the image was delivered.

Video fallback

If Feishu media sending fails, fallback to sending a direct link if one exists. State clearly that this is a fallback.

Recommended agent usage

For a multimodal content agent, use this skill after generation:

• image result -> send-image.mjs
• mp4 result -> send-media.mjs

This keeps protocol details out of the model prompt and reduces failure risk for weaker models.