Feishu Send Media

Send images, files, audio, video and other media to Feishu users or chats. Use when user asks to send, share, or transfer media files via Feishu direct messa...

Security Scan

The skill's instructions and requirements match its stated purpose (sending local media via Feishu); there are no unexpected credentials, installs, or obfuscated code.

Purpose & Capability

Name/description (send media to Feishu) align with the runtime instructions: the SKILL.md explains how to send local files or base64 images via a message tool. Requesting access to local file paths and using path/base64 methods is proportionate to the stated purpose.

Instruction Scope

Instructions direct the agent to copy files into ~/.openclaw/workspace, verify existence, convert to base64, and send — all within the expected scope. Minor concerns: the workflow encourages copying arbitrary local files (so the agent will read user filesystem content) and uses shell commands (cp, readlink -f, base64); these are expected for file-sending but mean a malicious agent could abuse the skill to exfiltrate arbitrary files. Also, readlink -f is not available on some systems (macOS BSD readlink), which is a functional (not security) note.

Install Mechanism

Instruction-only skill with no install spec or downloads; nothing is written to disk by the skill itself. This is the lowest-risk install mechanism.

Credentials

The skill requests no environment variables or credentials — coherent because it delegates sending to a 'message' tool that presumably holds Feishu auth. Users should verify that the agent's message tool is properly scoped and authenticated to the intended Feishu account; absence of declared credentials means the skill assumes existing tool-level credentials.

Persistence & Privilege

always:false and user-invocable:true — the skill does not request permanent inclusion or elevated platform privileges. It does not modify other skills or system-wide settings in the instructions.

Scan Findings in Context

[no_regex_matches] expected: Scanner found no code to analyze because this is an instruction-only skill (SKILL.md only). No regex findings is expected for such skills; absence of findings does not eliminate runtime risks described in the instructions.

Assessment

This skill appears coherent for sending files to Feishu, but it will cause the agent to read and send local files — only use it when you trust the agent and the target Feishu account. Before installing: (1) confirm the agent's 'message' tool is authenticated only to the intended Feishu account and has appropriate scope, (2) avoid copying sensitive system files into the workspace, (3) be aware the workflow runs shell commands (cp, readlink, base64) so it requires filesystem permissions, and (4) verify file size limits and that readlink -f may not work on all OSes (adjust command on macOS). If you need tighter controls, require explicit user confirmation before any file is copied or sent.

Send media files (images, documents, audio, video) directly to Feishu users or chats using the message tool.

Sending Media

Basic File Send

Use the message tool with action: send and path parameter:

{
  "action": "send",
  "target": "ou_xxx",  // user open_id or chat_id
  "path": "/path/to/file.pdf"
}

Supported types:

• Images: .png, .jpg, .jpeg, .gif, .webp
• Documents: .doc, .docx, .pdf, .txt, .rtf
• Audio: .mp3, .wav, .m4a
• Video: .mp4, .mov

Parameters:

• target: User open_id (e.g., ou_3ac66d1ad7b8c1xxxxxxxxxxxxxxs) or chat ID
• path: Absolute path to local file
• Optional filename: Override display name

Sending to Group Chats

Use chat_id as target:

{
  "action": "send",
  "target": "oc_xxx",  // group chat ID
  "path": "/path/to/file.pdf"
}

Inline Images

For images to display inline in the message (not as attachments), use the image parameter with base64:

{
  "action": "send",
  "target": "ou_xxx",
  "image": "data:image/png;base64,..."
}

High-Reliability Workflow (Recommended)

Follow these steps exactly for maximum success rate:

Step 1: Copy file to workspace

cp /source/path/to/file.png ~/.openclaw/workspace/

Always use workspace directory (~/.openclaw/workspace/), never use desktop or downloads directly.

Step 2: Verify file exists

ls -la ~/.openclaw/workspace/filename.*

If file doesn't exist, abort and report error.

Step 3: Get absolute path

readlink -f ~/.openclaw/workspace/filename.png

Use the absolute path (e.g., /Users/casia/.openclaw/workspace/filename.png)

Step 4: Send with message tool

{
  "action": "send",
  "target": "ou_xxx",
  "path": "/Users/casia/.openclaw/workspace/filename.png"
}

Step 5: Verify response

Check the tool response for "messageId" field. If present, the send was successful. If error, try fallback method.

Fallback Methods

Fallback 1: Use base64 for images

If path method fails, convert image to base64:

base64 -i ~/.openclaw/workspace/filename.png

Then send with:

{
  "action": "send",
  "target": "ou_xxx",
  "image": "data:image/png;base64,<base64_string>"
}

Fallback 2: Upload to Feishu drive first

If both above fail, upload to Feishu cloud drive, then send the file link.

Error Handling

• File not found: Always copy to workspace first
• Permission denied: Check file permissions with ls -la
• File too large: For files >20MB, use Feishu drive instead
• Unknown error: Try base64 fallback or upload to drive

Quick Reference

File Type	Best Method	Fallback
Images (<5MB)	path → base64	-
Documents	path	Upload to drive
Audio/Video	path	Upload to drive
Large files	Upload to drive	-

Golden Rule: Always copy to workspace first, then send from there.