Feishu News

A skill to fetch and reference news information from Feishu when interacting with users.

Security Scan

The skill claims live Feishu API integration but the included code is a local mock and there are missing credentials/auth details; this mismatch is suspicious though not obviously malicious.

Purpose & Capability

The name/description promise fetching current news from Feishu. The repository includes a requirements.txt with feishu-sdk and network-related libraries (requests, bs4) — which matches the stated purpose — but the actual implementation (scripts/fetch_news.py) is a static mock returning hard-coded items and does not call any Feishu API. That inconsistency (advertised live integration vs. mock code) is unexplained.

Instruction Scope

SKILL.md instructs the agent to fetch news from Feishu and lists functions like fetch_news() and reference_source(). It does not instruct the agent to read system files or unrelated secrets, which is good, but it also gives no guidance about authentication or where to obtain API credentials. The instructions claim API integration but provide no runtime steps to configure auth, leaving an implementation gap.

Install Mechanism

There is no install spec (instruction-only), so nothing will be fetched from arbitrary URLs. A requirements.txt declares feishu-sdk, requests, beautifulsoup4, and pandas; these are plausible for a news-fetching skill, though pandas may be heavier than necessary for simple formatting. The lack of an install script means package installation behavior depends on the host platform — not on the skill itself.

Credentials

The skill requests no environment variables or credentials, but real Feishu API integration typically requires credentials (API key/secret or OAuth tokens). The absence of declared env vars or primary credential is inconsistent with the stated API usage and could indicate an incomplete stub or an assumption that credentials will be provided elsewhere (which increases risk).

Persistence & Privilege

always is false and there is no indication the skill requests persistent or elevated privileges, nor does it modify other skills or system-wide configuration. Autonomous invocation is allowed but that's the platform default and not by itself concerning here.

What to consider before installing

This skill advertises live Feishu news integration but the provided Python code is a local mock that returns hard-coded articles and does not call Feishu or require credentials. Before installing, confirm whether you expect a stub or a real integration: if you need live data, ask the publisher how credentials are supplied and whether the skill will use secure auth flows. Be cautious about installing requirements (feishu-sdk, requests, beautifulsoup4, pandas) on systems where third-party packages are sensitive. If you plan to use this in production, request a real implementation that documents required env vars, auth steps, and network endpoints; otherwise treat it as a demo/stub only.

Feishu News Skill

This skill enables fetching and referencing news information from Feishu when interacting with users. It provides a way to incorporate current news sources into conversations.

Usage Examples

• "Fetch latest news from Feishu"
• "Show me recent news articles"
• "Reference news sources in our conversation"
• "Get news updates from Feishu"

Available Functions

• fetch_news(): Retrieves latest news from Feishu
• reference_source(article_id): References a specific news source
• format_news(news_data): Formats news data for user presentation
• get_news_sources(): Returns available news sources

How It Works

This skill integrates with Feishu's news system to provide current information. When users request news or references, the skill:

1. Fetches relevant news articles from Feishu
2. Formats the information with proper source attribution
3. Presents the information to the user with clear references

Integration Details

The skill uses Feishu's API to access news content and ensures proper attribution of news sources when referenced in conversations.