Feishu Robot Creater For 26462 Final

AdvisoryAudited by Static analysis on May 1, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone who obtains the App Secret may be able to configure or impersonate the Feishu bot integration.

Why it was flagged

The skill requires Feishu application credentials so OpenClaw can connect to the bot. This is purpose-aligned, but these credentials grant access to the Feishu app integration.

Skill content
复制以下信息:- **App ID**(格式:`cli_xxxxxx`)- **App Secret**(点击「获取」按钮后复制)
Recommendation

Store the App ID/App Secret securely, avoid pasting them into unrelated chats or files, restrict Feishu app permissions to what is needed, and rotate the secret if exposed.

What this means

Running the restart command may interrupt existing OpenClaw Gateway sessions or integrations.

Why it was flagged

The skill instructs the user to run OpenClaw Gateway commands. Restarting Gateway is expected for this setup, but it can affect running OpenClaw connections.

Skill content
openclaw gateway status
openclaw gateway restart
Recommendation

Run these commands manually after reviewing them, save or back up existing configuration first, and restart Gateway only when an interruption is acceptable.

What this means

Information written to the agent memory may persist and influence future agent behavior.

Why it was flagged

The skill initializes a persistent MEMORY.md file intended to store user information and preferences for the new agent.

Skill content
## 用户信息
(待填写)

## 偏好习惯
(待填写)
Recommendation

Only store information you intend the agent to remember, periodically review MEMORY.md, and delete or edit sensitive entries when no longer needed.

What this means

Messages sent to the Feishu bot can reach the configured OpenClaw Agent, so unintended users or permissions could expose conversations to the agent.

Why it was flagged

The skill sets up routing between an external Feishu bot account and an OpenClaw Agent through Gateway. This cross-system communication is the stated purpose, but users should ensure the channel is scoped correctly.

Skill content
目标是让:- 飞书账号 `<agent-id>` - 路由到 Agent `<agent-id>`
Recommendation

Confirm Feishu event subscriptions, tenant/app visibility, and OpenClaw routing so only intended users and messages are connected to the agent.