Feishu Media Sender

飞书媒体发送器 — 上传图片或视频并以媒体消息发送到飞书聊天中。图片直接预览，视频支持播放。补齐飞书渠道缺失的媒体投递能力。| Feishu Media Sender — Upload & send images/videos via Feishu OpenAPI with in-chat preview/pla...

Security Scan

The skill's code, runtime instructions, and requested local config are coherent with its stated purpose of uploading and sending media to Feishu; it reads Feishu credentials from your OpenClaw config and uses the official Feishu OpenAPI endpoints.

Purpose & Capability

Name/description (Feishu media upload + send) match what the code does: obtains Feishu tenant token, uploads images/videos to official Feishu endpoints, and sends messages. Required binary (python3) and the declared OpenClaw config path (~/.openclaw/openclaw.json) are consistent with selecting Feishu app credentials.

Instruction Scope

SKILL.md instructs running the included Python script with a local file and receive-id, and explicitly states credentials are read from ~/.openclaw/openclaw.json. The script's actions (reading that config, determining account binding, calling Feishu APIs, uploading local file) align with the documented instructions and do not reference unrelated system files or external endpoints beyond Feishu.

Install Mechanism

This is instruction-only (no install spec). A single Python script is bundled; there are no downloads or archive extracts and no third-party install sources. Risk from installation is low.

Credentials

The skill requires access to ~/.openclaw/openclaw.json to read Feishu appId/appSecret, which is appropriate. Note: the script also uses optional environment fallbacks for the receive_id (OPENCLAW_CHAT_ID, OPENCLAW_RECEIVE_ID, FEISHU_CHAT_ID) though these env vars are not declared in requires.env — they are only optional fallbacks. The script reads other parts of the openclaw.json (agents, bindings) to resolve which account to use; this is justified for multi-account selection but means the skill will parse your full OpenClaw config, so ensure it contains only expected credentials.

Persistence & Privilege

always is false and the skill does not request any persistent platform privileges or modify other skills. It makes runtime network calls to Feishu APIs (expected). Autonomous invocation of skills is the platform default; this skill does not increase privileges beyond that.

Assessment

This skill appears to do exactly what it says: it uploads a local image/video and sends it via Feishu using appId/appSecret read from your ~/.openclaw/openclaw.json. Before installing, verify that ~/.openclaw/openclaw.json contains the intended Feishu app credentials and no unexpected secrets. Be aware the script will parse agents/bindings in that config to choose an account, and it also accepts optional environment fallbacks (OPENCLAW_CHAT_ID / OPENCLAW_RECEIVE_ID / FEISHU_CHAT_ID) for the target receive_id. If you are uncomfortable with a skill reading your full OpenClaw config, remove or restrict Feishu credentials in that file and supply them differently, or run the script in an environment with a minimal openclaw.json. Finally, treat files you upload as sensitive data: the script will transmit file contents to Feishu endpoints.

Feishu Media Sender | 飞书媒体发送器

Upload images or videos to Feishu and send as media messages with in-chat preview/playback.

将图片或视频上传至飞书并以媒体消息发送，聊天中可直接预览/播放。

Quick Start

# Send image (auto-detect)
python3 scripts/feishu_send_media.py --file photo.jpg --receive-id ou_xxx

# Send video
python3 scripts/feishu_send_media.py --file video.mp4 --receive-id ou_xxx

# Explicit type override
python3 scripts/feishu_send_media.py --file clip.gif --receive-id ou_xxx --type video

Arguments

Param	Required	Description
--file	✅	Local file path (absolute)
--receive-id	optional	Target chat_id or open_id. Falls back to OPENCLAW_CHAT_ID env var
--receive-id-type	optional	Auto-detected from prefix: oc_ → chat_id, ou_ → open_id
--type	optional	image or video. Auto-detected from file extension if omitted

Supported Formats

Image: JPG, JPEG, PNG, WEBP, GIF, BMP, ICO, TIFF, HEIC (max 10 MB)

Video: MP4, MOV, AVI, MKV, WEBM (max 30 MB, uploaded as MP4)

How It Works

Images:

1. Upload via /im/v1/images → get image_key
2. Send message with msg_type=image, content {"image_key": "..."}

Videos:

1. Upload via /im/v1/files (file_type=mp4) → get file_key
2. Send message with msg_type=media, content {"file_key": "..."}

Credentials are auto-read from ~/.openclaw/openclaw.json.

API Reference

• Upload Image
• Upload File
• Send Message