OpenClaw Feishu Group Chat

Teach OpenClaw how to work in Feishu (Lark) group chats — recognize who's talking, behave properly in groups vs DMs, respect multi-user privacy, and format m...

Security Scan

The skill is internally coherent: it fetches Feishu contacts with the app credentials from your local openclaw.json and updates USER.md to map open_id→name, but the package metadata omits the fact that it requires a config file path and will read local credentials.

Purpose & Capability

The code and SKILL.md match the stated purpose (identify senders in Feishu by syncing contacts and populating a USER.md lookup). However, the registry metadata lists no required config paths or credentials while the instructions and script clearly require reading openclaw.json for Feishu app credentials — a documentation/metadata omission that should be corrected.

Instruction Scope

SKILL.md stays on-topic: it instructs the agent to run the bundled sync script, add guidance snippets to AGENTS/SOUL files, and restart the gateway. The runtime steps are limited to reading a local config, calling Feishu APIs, and updating USER.md; there are no instructions to read unrelated system files or send data to unexpected endpoints.

Install Mechanism

This is an instruction-only skill with one included Python script — no downloads, package installs, or extraction of remote archives. The install surface is minimal and appropriate for the task.

Credentials

No env vars are declared in registry metadata, yet the script requires a path to openclaw.json (which contains appId/appSecret) and will read it. Requesting Feishu app credentials is appropriate for contacting the contacts API, but the skill should declare the config path requirement in metadata and explicitly note that it reads the local config file. Also note the script loads the entire JSON file into memory, which may contain other channel credentials; the script uses only the specified Feishu account but will have access to the whole file at runtime.

Persistence & Privilege

The skill does not request always:true and is user-invocable. Its persistent action (writing the contacts table into USER.md) is expected and scoped to workspace files. It does not modify other skills or global agent settings.

Assessment

This skill appears to do what it says: it uses your Feishu app credentials from openclaw.json to fetch users and writes a contacts table into USER.md. Before installing or running: (1) Confirm and backup your openclaw.json and USER.md. (2) Verify openclaw.json contains only the credentials you intend the script to access (or run the script against a copy), because the script reads the entire JSON file and will have access to any other credentials stored there. (3) Update the skill metadata (or ask the provider) so it declares the required config path and clearly documents that it needs the Feishu appId/appSecret. (4) Run the script locally first to inspect its output and ensure the USER.md section matches your expectations. If you cannot inspect or control the local config file, avoid running the script.

Everything your OpenClaw agent needs to be a good Feishu group chat participant.

1. Know who you're talking to

Feishu group messages include sender names in metadata. DMs don't — they only include an opaque open_id. Without setup, your agent will assume all DMs come from one person.

Fix: Embed an open_id → name lookup table in USER.md. Since workspace files are injected into the system prompt, the agent matches senders instantly — no tool calls.

Run the bundled sync script to pull your org's contacts:

python3 scripts/sync_feishu_contacts.py <openclaw_config> <feishu_account> <user_md_path>

This populates a table in USER.md:

## 飞书通讯录 (App Name)
飞书 DM 不携带发送者姓名。用 inbound metadata 的 chat_id（格式 `user:ou_xxx`）匹配下表识别发送者。
| 姓名 | open_id |
|------|---------|
| Alice | ou_abc123 |
| Bob | ou_def456 |

Important: Feishu open_id is per-app. Multiple OpenClaw instances using different Feishu apps must each pull contacts with their own credentials.

After updating USER.md, restart the gateway. Workspace files are cached at startup; /new alone won't pick up changes.

Set up weekly auto-sync via crontab:

0 7 * * 1 python3 /path/to/scripts/sync_feishu_contacts.py ~/.openclaw/openclaw.json my_app ~/workspace/USER.md

2. Group chat etiquette

Add to AGENTS.md or SOUL.md:

When to respond:

• Directly @mentioned
• Can add real value to the conversation
• Something witty or relevant fits naturally

When to stay silent:

• Casual banter you have nothing to add to
• Someone already answered well
• "Yeah" / "Nice" / emoji-only territory

General rules:

• Don't dominate the conversation — participate, don't monologue
• One reaction per message max
• Keep replies concise — respect the group's attention

3. DM behavior

• Always address the sender by their actual name (look up from the contacts table)
• Never assume a DM is from your "primary human" — anyone can message you
• Keep conversations isolated — never leak what person A said to person B
• Be more thorough in DMs than in groups (the person came to you specifically)

4. Platform formatting

Feishu does NOT render Markdown well. Follow these rules:

• No markdown: No **bold**, # headers, or [links](url) in messages
• No tables: Use simple lists with dashes instead
• Plain text only: Use line breaks and spacing for structure
• Code blocks: Feishu does support code blocks — use sparingly

5. Multi-user privacy

Add to SOUL.md or AGENTS.md:

• Different users' conversation contents are isolated from each other
• Don't reveal what A discussed with you to B, even if B is the admin
• Each person's DM is a private space
• In group chats, don't share anyone's private information

6. Sender identification (AGENTS.md snippet)

Add this to your startup sequence:

识别消息发送者：飞书 DM 不携带发送者姓名，只有 open_id（inbound metadata 的 chat_id 格式 user:ou_xxx）。
提取 open_id，在 USER.md 的飞书通讯录表格中匹配找到姓名。
不要假设 DM 对方就是主人——任何人都可能给你发私聊。
群聊消息自带 Sender metadata 可直接使用。

Privacy

• Only names and open_ids are stored (no emails, phones, or PII)
• open_id is opaque, meaningful only within your Feishu app
• App credentials are read at runtime from openclaw.json, never stored in skill files