Feishu Messaging.Bak2

飞书消息发送与文档创建工作流。 触发场景：查找群成员、查找群ID、发送消息失败需要重新尝试。 适用于：发送飞书消息。

Security Scan

The skill's functionality matches its description, but it includes hard-coded Feishu app credentials and fails to declare required environment variables and has metadata inconsistencies — this mismatch is suspicious and should be vetted before use.

Purpose & Capability

Name/description and the included code all target Feishu (open.feishu.cn) message/document APIs — capability aligns with purpose. However, the skill declares no required env vars or primary credential while the runtime scripts clearly expect FEISHU_APP_ID/FEISHU_APP_SECRET or fall back to embedded credentials, which is inconsistent.

Instruction Scope

SKILL.md examples and scripts only call Feishu APIs and show typical usage (search chat, send messages, upload files). They do not appear to read unrelated system files or contact external endpoints beyond open.feishu.cn. But the instructions and examples assume app_id/app_secret are available without declaring them; the runtime files embed defaults, which broadens the effective scope (use of those specific credentials).

Install Mechanism

Instruction-only skill with included small JS scripts; no install spec, no third-party downloads, and no archives being extracted — low install risk.

Credentials

The skill requests no environment variables in metadata, yet the scripts read FEISHU_APP_ID and FEISHU_APP_SECRET (and provide hard-coded fallback values). Embedding real-looking app_id and app_secret values in code is a sensitive practice: those credentials could be valid and allow the app to act in other tenants. The number and nature of secrets (app secret values) are disproportionate to the metadata's 'none' declaration and should be clarified/removed.

Persistence & Privilege

always is false and the skill does not request any persistent system-wide privileges. It does not modify other skills or agent-wide settings.

Scan Findings in Context

[hardcoded-secret] unexpected: Multiple scripts contain hard-coded FEISHU_APP_ID and FEISHU_APP_SECRET values (e.g., APP_ID 'cli_a93d0180c0b99cba', APP_SECRET 'KJXQ3hqdRerYwyThNq999gL2btUSkOaR'). A messaging integration should accept credentials via configuration, not embed secrets.

[declared-env-mismatch] unexpected: Registry metadata lists no required environment variables or primary credential, but scripts read FEISHU_APP_ID/FEISHU_APP_SECRET from environment and use fallbacks. The metadata should declare these env vars if they are required.

[metadata-owner-mismatch] unexpected: _meta.json ownerId ('kn7bsdhpz7e3pyqbbtabcswgp980ncty') differs from registry ownerId in the provided metadata ('kn74xs6g8kpwn9hyjkn05k0kgx82tbvr'), which may indicate packaging/integrity issues or that files were copied/modified.

What to consider before installing

This skill appears to do what it says (send/search Feishu messages), but stop and verify before installing. Key concerns: (1) the JS files include hard-coded Feishu app_id/app_secret values — treat these as sensitive credentials; they may be valid and could allow the app to act on behalf of that integration. (2) The skill metadata declares no required env vars, yet the code expects FEISHU_APP_ID and FEISHU_APP_SECRET (or falls back to embedded defaults) — the mismatch is sloppy and risky. (3) Metadata owner ID in _meta.json doesn't match the registry ownerId, which could mean files were copied or tampered with. Recommended actions: do not run in production or on systems with real data until you confirm the provenance; request the publisher/source and ask them to (a) remove embedded secrets, (b) declare required env vars in metadata, and (c) republish with matching metadata. If you already supplied any of the embedded credentials elsewhere, rotate them. If you must test, do so in an isolated account or sandbox and monitor for unexpected message activity.

飞书消息与文档 Skill

概述

此 Skill 通过飞书开放平台 API 帮助用户发送消息、创建文档和管理飞书资源。

核心能力

功能	状态	所需权限
发送文本消息	✅ 可用	im:message:send_as_bot
获取群聊列表	✅ 可用	im:chat:readonly
获取群成员	✅ 可用	im:chat.members:read

使用方法

发送消息给指定用户

给 [姓名] 发一条飞书消息，告诉他 [内容]

前置条件：需要获取用户的 open_id

1. 获取群聊id的方法

import json

import lark_oapi as lark
from lark_oapi.api.im.v1 import *


def main():
    # 创建client
    client = lark.Client.builder() \
        .app_id("YOUR_APP_ID") \
        .app_secret("YOUR_APP_SECRET") \
        .log_level(lark.LogLevel.DEBUG) \
        .build()

    # 构造请求对象
    request: SearchChatRequest = SearchChatRequest.builder() \
        .user_id_type("open_id") \
        .query("小鸭子") \
        .page_size(20) \
        .build()

    # 发起请求
    response: SearchChatResponse = client.im.v1.chat.search(request)

    # 处理失败返回
    if not response.success():
        lark.logger.error(
            f"client.im.v1.chat.search failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")
        return

    # 处理业务结果
    lark.logger.info(lark.JSON.marshal(response.data, indent=4))


if __name__ == "__main__":
    main()

2. 发送消息

import json

import lark_oapi as lark
from lark_oapi.api.im.v1 import *


def main():
    # 创建client
    client = lark.Client.builder() \
        .app_id("YOUR_APP_ID") \
        .app_secret("YOUR_APP_SECRET") \
        .log_level(lark.LogLevel.DEBUG) \
        .build()

    # 构造请求对象
    request: CreateMessageRequest = CreateMessageRequest.builder() \
        .receive_id_type("open_id") \
        .request_body(CreateMessageRequestBody.builder()
            .receive_id("ou_7d8a6e6df7621556ce0d21922b676706ccs")
            .msg_type("text")
            .content("{\"text\":\"test content\"}")
            .uuid("选填，每次调用前请更换，如a0d69e20-1dd1-458b-k525-dfeca4015204")
            .build()) \
        .build()

    # 发起请求
    response: CreateMessageResponse = client.im.v1.message.create(request)

    # 处理失败返回
    if not response.success():
        lark.logger.error(
            f"client.im.v1.message.create failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")
        return

    # 处理业务结果
    lark.logger.info(lark.JSON.marshal(response.data, indent=4))


if __name__ == "__main__":
    main()

3. 图片消息

import json

import lark_oapi as lark
from lark_oapi.api.im.v1 import *


def main():
    # 创建client
    client = lark.Client.builder() \
        .app_id("YOUR_APP_ID") \
        .app_secret("YOUR_APP_SECRET") \
        .log_level(lark.LogLevel.DEBUG) \
        .build()

    # 构造请求对象
    file = open("小鸭子.jpg", "rb")
    request: CreateImageRequest = CreateImageRequest.builder() \
        .request_body(CreateImageRequestBody.builder()
            .image_type("message")
            .image(file)
            .build()) \
        .build()

    # 发起请求
    response: CreateImageResponse = client.im.v1.image.create(request)

    # 处理失败返回
    if not response.success():
        lark.logger.error(
            f"client.im.v1.image.create failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")
        return

    # 处理业务结果
    lark.logger.info(lark.JSON.marshal(response.data, indent=4))


if __name__ == "__main__":
    main()

4. 上传文件

import json

import lark_oapi as lark
from lark_oapi.api.im.v1 import *


def main():
    # 创建client
    client = lark.Client.builder() \
        .app_id("YOUR_APP_ID") \
        .app_secret("YOUR_APP_SECRET") \
        .log_level(lark.LogLevel.DEBUG) \
        .build()

    # 构造请求对象
    file = open("飞书20260129-173520.mp4", "rb")
    request: CreateFileRequest = CreateFileRequest.builder() \
        .request_body(CreateFileRequestBody.builder()
            .file_type("mp4")
            .file_name(""1.mp4"")
            .duration("3000")
            .file(file)
            .build()) \
        .build()

    # 发起请求
    response: CreateFileResponse = client.im.v1.file.create(request)

    # 处理失败返回
    if not response.success():
        lark.logger.error(
            f"client.im.v1.file.create failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")
        return

    # 处理业务结果
    lark.logger.info(lark.JSON.marshal(response.data, indent=4))


if __name__ == "__main__":
    main()

5. 查询群成员

import json

import lark_oapi as lark
from lark_oapi.api.im.v1 import *


def main():
    # 创建client
    client = lark.Client.builder() \
        .app_id("YOUR_APP_ID") \
        .app_secret("YOUR_APP_SECRET") \
        .log_level(lark.LogLevel.DEBUG) \
        .build()

    # 构造请求对象
    request: GetChatMembersRequest = GetChatMembersRequest.builder() \
        .chat_id("oc_dcc94d101e8d41e291e90f4623eca17a") \
        .member_id_type("user_id") \
        .build()

    # 发起请求
    response: GetChatMembersResponse = client.im.v1.chat_members.get(request)

    # 处理失败返回
    if not response.success():
        lark.logger.error(
            f"client.im.v1.chat_members.get failed, code: {response.code}, msg: {response.msg}, log_id: {response.get_log_id()}, resp:
{json.dumps(json.loads(response.raw.content), indent=4, ensure_ascii=False)}")
        return

    # 处理业务结果
    lark.logger.info(lark.JSON.marshal(response.data, indent=4))


if __name__ == "__main__":
    main()

文档

• 飞书 API 文档