Feishu Send Message as App

Send a Feishu IM message as the app (bot identity). Use when you need to send a message that appears to come from the bot/app, not the user. Uses App Access...

Security Scan

The skill appears to perform the claimed action (sending Feishu messages as an app) but its metadata omits that it reads app credentials from an on-disk config and caches tokens in /tmp — an incoherence that merits caution before installing.

Purpose & Capability

The skill's purpose (send Feishu messages as the app) matches the included script. However the registry metadata declares no required credentials or config paths while SKILL.md and the script read appId and appSecret from openclaw.json (default /root/.openclaw/openclaw.json). The omission in metadata is an inconsistency that could hide sensitive file access.

Instruction Scope

SKILL.md and scripts instruct the agent to read credentials from openclaw.json, call Feishu API endpoints, and cache an app token in /tmp/feishu_app_token.cache. The instructions stay within the Feishu API domain, but they reference and read a local config file that was not declared in the registry, which expands scope beyond what's advertised.

Install Mechanism

No install spec; this is an instruction-only skill with a small included shell script. Nothing is downloaded or written during install beyond the script itself.

Credentials

Registry lists no required environment variables or primary credential, yet the script requires appId/appSecret (read from openclaw.json) and supports optional FEISHU_* env vars for convenience. Requesting access to local stored credentials without declaring them is disproportionate to the metadata and should be justified.

Persistence & Privilege

The skill is not marked always:true and does not modify other skills. It writes a cached app token to /tmp/feishu_app_token.cache (temporary, potentially world-readable) but otherwise does not request persistent elevated privileges.

What to consider before installing

This skill's code does what it says (gets an app token and posts to Feishu), but the registry metadata fails to declare that it reads appId/appSecret from an openclaw.json file (default /root/.openclaw/openclaw.json). Before installing: (1) confirm where your Feishu app credentials are stored and whether you want this skill to read that file; (2) ensure the openclaw.json file permissions are restrictive and that you trust the skill's origin; (3) be aware the script caches the app token in /tmp (may be readable by other users on the host); (4) review the script locally to ensure it matches your expectations and consider testing in an isolated environment. If you need higher assurance, ask the publisher to update registry metadata to declare the required config path and to explain token caching behavior.

Send a Feishu IM message with app/bot identity — not user identity.

Usage

bash <skill-dir>/scripts/send-message.sh <receive_id> <msg_type> <content> [open_id|chat_id]

Examples

# Text message
bash <skill-dir>/scripts/send-message.sh ou_xxx text "Hello"

# Image message (use image_key from feishu-upload-image)
bash <skill-dir>/scripts/send-message.sh ou_xxx image '{"image_key":"img_v3_xxx"}'

# Post message (rich text)
bash <skill-dir>/scripts/send-message.sh ou_xxx post '{"zh_cn":{"title":"Title","content":[[{"tag":"text","text":"Hello"}]]}}'

# To a group chat
bash <skill-dir>/scripts/send-message.sh oc_xxx text "Hello" chat_id

Environment variables

export FEISHU_RECEIVE_ID="ou_xxx"
export FEISHU_MSG_TYPE="text"
export FEISHU_CONTENT="Hello"
bash <skill-dir>/scripts/send-message.sh

Workflow with feishu-upload-image

# 1. Upload image → get image_key
IMAGE_KEY=$(bash <feishu-upload-image-dir>/scripts/upload-image.sh /path/to/image.png)

# 2. Send as app
bash <skill-dir>/scripts/send-message.sh ou_xxx image "{\"image_key\":\"$IMAGE_KEY\"}"

Output

message_id: om_xxxxxxxxxxxxxxxx

Credentials

Reads appId and appSecret from openclaw.json at channels.feishu.