Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Feishu Openclaw Integration

v1.0.0

飞书 + OpenClaw 无缝集成 - 5 分钟搭建企业 AI 助手。支持群聊机器人、智能客服、自动化工作流。

0· 108·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yang1002378395-cmyk/feishu-openclaw-integration.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Feishu Openclaw Integration" (yang1002378395-cmyk/feishu-openclaw-integration) from ClawHub.
Skill page: https://clawhub.ai/yang1002378395-cmyk/feishu-openclaw-integration
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: FEISHU_APP_ID, FEISHU_APP_SECRET
Required binaries: node, npm
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feishu-openclaw-integration

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-openclaw-integration
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, required binaries (node/npm), and FEISHU_APP_ID/FEISHU_APP_SECRET align with a Feishu integration that can run a Node-based bridge. However the SKILL.md advertises an 'OpenClaw built‑in' zero-code option but still requires node/npm in metadata — that is inconsistent (the built‑in path may not need node). Also primary credential is unset even though FEISHU_APP_SECRET is effectively the main secret.
!
Instruction Scope
The instructions tell the agent/operator to read full chat history, download uploaded files, and POST message and file contents to an OPENCLAW_URL endpoint. That data flow is expected for an integration, but SKILL.md uses OPENCLAW_URL (and implicitly allows it to be remote) while OPENCLAW_URL is not declared in requires.env. The instructions also ask editing ~/.openclaw/config/channels.json (adds encryptKey/verificationToken) which is reasonable, but the skill fails to declare where encrypt/verification tokens should come from. Overall the agent would be permitted to collect and transmit potentially sensitive chat and file data to whatever OpenClaw endpoint is configured — this needs explicit declaration and security guidance.
Install Mechanism
No install spec and no code files — instruction-only skill. This is low-risk from an install/download perspective (nothing is written/executed by an installer).
!
Credentials
The declared required env vars (FEISHU_APP_ID, FEISHU_APP_SECRET) are appropriate. But SKILL.md also relies on OPENCLAW_URL (defaulting to http://localhost:3000) and references encryptKey and verificationToken for Feishu callbacks without declaring them as required environment inputs. The omission means the runtime behavior (where data is sent) and required secrets are not fully specified. The skill does not request unrelated credentials, but the undeclared external endpoint and callback secrets are notable gaps.
Persistence & Privilege
always is false, no install spec, and the skill doesn't request system-wide persistent privileges. Agent autonomous invocation is allowed (platform default) but not combined with broad unexplained permissions here.
What to consider before installing
This skill appears to implement a normal Feishu ↔ OpenClaw bridge, but there are gaps you should resolve before use: - Confirm where OpenClaw will run: SKILL.md uses OPENCLAW_URL (default http://localhost:3000) but that environment variable is not declared. If you configure a remote OpenClaw, chat messages and file contents will be POSTed to that URL — only point it at a trusted, TLS-protected server. - Clarify and protect callback secrets: the instructions ask you to store encryptKey and verificationToken in ~/.openclaw/config/channels.json but these values are not listed as required env vars. Treat these secrets carefully (don't check into source control) and prefer environment variables or a secrets store. - Review data flow: the skill downloads uploaded files and sends their contents to OpenClaw for analysis. If those files contain sensitive data, ensure your OpenClaw deployment and network are trusted and access-controlled. - Metadata inconsistencies: the SKILL.md advertises a zero-code built-in path, yet the registry metadata requires node/npm. Ask the publisher to: (1) declare OPENCLAW_URL and any callback secrets in requires.env or explain why they are unnecessary, (2) set primary credential appropriately (FEISHU_APP_SECRET), and (3) clarify when node/npm are actually required. If you cannot verify the publisher or confirm these points, avoid installing or running the skill in production or on accounts with sensitive data. Run in an isolated environment and monitor network destinations it contacts.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🚀 Clawdis
Binsnode, npm
EnvFEISHU_APP_ID, FEISHU_APP_SECRET
latestvk97bn4cmqqcek96t6p23nay11h83seg2
108downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

飞书 + OpenClaw 集成 Skill

5 分钟搭建企业 AI 助手 - 零代码,即插即用。

核心价值

  • 零代码 - 配置即用,无需编程
  • 企业级 - 飞书官方 API,稳定可靠
  • 智能回复 - 接入 OpenClaw 大模型
  • 自动化 - 定时推送、事件触发
  • 私有化 - 数据不离开企业

快速开始

方式 1:OpenClaw 内置(推荐,5 分钟)

  1. 配置飞书频道(OpenClaw 已内置支持)
# 编辑 ~/.openclaw/config/channels.json
{
  "feishu": {
    "enabled": true,
    "appId": "YOUR_APP_ID",
    "appSecret": "YOUR_APP_SECRET",
    "encryptKey": "YOUR_ENCRYPT_KEY",
    "verificationToken": "YOUR_VERIFICATION_TOKEN"
  }
}
  1. 创建飞书应用(3 分钟)

    • 访问 https://open.feishu.cn
    • 创建「企业自建应用」
    • 启用「机器人」权限
    • 配置事件回调(OpenClaw 自动处理)
  2. 测试

    # 在飞书群@机器人
    @Jarvis 帮我写一份周报
    

方式 2:Node.js SDK(10 分钟)

# 安装依赖
npm install @larksuiteoapi/node-sdk axios

# 创建集成脚本
cat > feishu-bot.js << 'EOF'
const lark = require('@larksuiteoapi/node-sdk');
const axios = require('axios');

const client = new lark.Client({
  appId: process.env.FEISHU_APP_ID,
  appSecret: process.env.FEISHU_APP_SECRET,
});

const OPENCLAW_URL = process.env.OPENCLAW_URL || 'http://localhost:3000';

// 处理飞书消息
client.im.message.subscribe({
  on: async (event) => {
    const { message } = event;
    const content = JSON.parse(message.content);

    // 发送到 OpenClaw
    const response = await axios.post(`${OPENCLAW_URL}/api/chat`, {
      message: content.text,
      userId: message.sender_id,
      channel: 'feishu',
    });

    // 回复消息
    await client.im.message.create({
      receive_id_type: 'chat_id',
      params: { receive_id: message.chat_id },
      data: {
        msg_type: 'text',
        content: JSON.stringify({ text: response.data.reply })
      }
    });
  }
});
EOF

# 运行
FEISHU_APP_ID=xxx FEISHU_APP_SECRET=xxx node feishu-bot.js

实用场景

1. 群聊 AI 助手

# config/group-assistant.yaml
prompts:
  tech_group:
    system: "你是技术群的 AI 助手,专业、简洁、直接。"
    temperature: 0.3

  product_group:
    system: "你是产品群的 AI 助手,关注用户体验、需求分析。"
    temperature: 0.7

2. 智能客服

# 自动回复规则
AUTO_REPLY = {
    '价格': '基础版 ¥99,高级版 ¥299',
    '售后': '请联系售后微信:xxx',
    '发票': '提供增值税普通发票,开票请联系财务',
}

def handle_keyword(text):
    for keyword, reply in AUTO_REPLY.items():
        if keyword in text:
            return reply
    return None  # 转到 OpenClaw 处理

3. 定时通知

// 每天早上 9 点发送日报提醒
const schedule = require('node-schedule');

schedule.scheduleJob('0 9 * * *', async () => {
  await client.im.message.create({
    receive_id_type: 'chat_id',
    params: { receive_id: 'WORK_GROUP_ID' },
    data: {
      msg_type: 'interactive',
      content: JSON.stringify({
        config: {
          wide_screen_mode: true
        },
        elements: [{
          tag: 'div',
          text: {
            tag: 'lark_md',
            content: '📊 **日报提醒**\n\n请大家在今天 18:00 前提交日报'
          }
        }]
      })
    }
  });
});

4. 数据分析

// 分析群聊数据,生成报告
async function generateReport(chatId) {
  const messages = await client.im.message.list({
    params: {
      container_id_type: 'chat_id',
      container_id: chatId,
      page_size: 100
    }
  });

  // 发送给 OpenClaw 分析
  const analysis = await axios.post(`${OPENCLAW_URL}/api/analyze`, {
    data: messages,
    task: '总结今天的讨论要点'
  });

  return analysis.data;
}

高级功能

消息卡片(富文本)

// 发送精美卡片
await client.im.message.create({
  receive_id_type: 'chat_id',
  params: { receive_id: chatId },
  data: {
    msg_type: 'interactive',
    content: JSON.stringify({
      config: { wide_screen_mode: true },
      header: {
        title: {
          tag: 'plain_text',
          content: '🚀 AI 分析报告'
        }
      },
      elements: [{
        tag: 'div',
        text: {
          tag: 'lark_md',
          content: '**关键结论**\n- 用户增长 20%\n- 留存率 85%'
        }
      }]
    })
  }
});

文件处理

// 处理上传的文件
if (message.msg_type === 'file') {
  const fileKey = JSON.parse(message.content).file_key;

  // 下载文件
  const file = await client.im.file.download({
    params: { type: 'file', file_key: fileKey }
  });

  // 发送给 OpenClaw 分析
  const result = await axios.post(`${OPENCLAW_URL}/api/analyze-file`, {
    file: file.data,
    task: '总结这份文档的关键信息'
  });
}

多 Agent 协作

// 不同群用不同 Agent
const AGENTS = {
  'TECH_GROUP_ID': 'jarvis',      // 技术群
  'PRODUCT_GROUP_ID': 'assistant', // 产品群
  'SALES_GROUP_ID': 'sales-bot',  // 销售群
};

async function routeMessage(chatId, text) {
  const agent = AGENTS[chatId] || 'default';

  return await axios.post(`${OPENCLAW_URL}/api/chat`, {
    message: text,
    agent: agent
  });
}

配置文件模板

~/.openclaw/feishu-config.yaml

# 飞书应用配置
app:
  id: "cli_xxxxxxxxx"
  secret: "xxxxxxxxxxxxxxxx"
  encrypt_key: "xxxxxxxxxxxxxxxx"
  verification_token: "xxxxxxxxxxxxxxxx"

# 机器人配置
bot:
  name: "Jarvis"
  avatar: "https://example.com/avatar.png"
  welcome_message: "你好!我是 AI 助手 Jarvis,有什么可以帮你的?"

# 自动回复
auto_reply:
  enabled: true
  rules:
    - keywords: ["价格", "多少钱"]
      reply: "基础版 ¥99,高级版 ¥299,企业定制请联系客服"
    - keywords: ["发票", "开票"]
      reply: "提供增值税普通发票,请联系财务"
    - keywords: ["售后", "客服"]
      reply: "售后微信:xxx"

# AI 配置
ai:
  model: "gpt-4"
  temperature: 0.7
  max_tokens: 2000
  system_prompt: "你是企业 AI 助手,专业、高效、简洁。"

# 群配置
groups:
  - chat_id: "oc_xxxxxxxxx"
    name: "技术群"
    agent: "jarvis-tech"
    enabled_commands: ["/code", "/review", "/help"]
  - chat_id: "oc_xxxxxxxxx"
    name: "产品群"
    agent: "jarvis-product"
    enabled_commands: ["/pr", "/analyze", "/summary"]

# 定时任务
schedule:
  - cron: "0 9 * * *"
    message: "📊 日报提醒:请在 18:00 前提交日报"
    target_groups: ["ALL"]
  - cron: "0 18 * * *"
    command: "/summary"
    target_groups: ["技术群", "产品群"]

常见问题

Q: 如何获取飞书应用凭证?

  1. 登录 https://open.feishu.cn
  2. 点击「创建应用」
  3. 选择「企业自建应用」
  4. 在应用详情页获取 App ID 和 App Secret

Q: 如何配置权限?

在飞书开放平台,应用需要开通以下权限:

  • im:message(发送消息)
  • im:message:group_at_msg(群@消息)
  • contact:user.base:readonly(读取用户信息)

Q: 支持哪些消息类型?

  • 文本消息
  • 图片消息
  • 文件消息
  • 富文本消息(卡片)
  • 互动消息(按钮)

Q: 如何处理高并发?

// 使用消息队列
const queue = require('bull');
const messageQueue = new queue('feishu-messages');

// 生产者
client.im.message.subscribe({
  on: (event) => {
    messageQueue.add(event);
  }
});

// 消费者(可横向扩展)
messageQueue.process(async (job) => {
  await handleFeishuMessage(job.data);
});

部署建议

开发环境

# 本地运行
npm install
npm start

生产环境(推荐)

# 使用 Docker
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
CMD ["node", "server.js"]

云部署(免运维)

  • Vercel - 自动扩缩容
  • Railway - 数据库 + 应用一键部署
  • Render - 免费套餐

技术支持


版本:1.0.0 更新:2026-03-17 作者:OpenClaw Community 许可:MIT

Comments

Loading comments...