Tmp Feishu Skill

AdvisoryAudited by Static analysis on May 1, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone who obtains the App Secret may be able to operate or configure the Feishu bot depending on granted permissions.

Why it was flagged

The skill asks the user to collect and later configure Feishu application credentials. This is expected for creating a Feishu bot, but the App Secret is sensitive account authority.

Skill content
复制以下信息:
   - **App ID**(格式:`cli_xxxxxx`)
   - **App Secret**(点击「获取」按钮后复制)

**请保存好这两个凭证,后续配置必须用到。**
Recommendation

Store the App Secret only in the intended OpenClaw/Feishu configuration or secret store, do not paste it into chats unnecessarily, and grant only the Feishu permissions required for message handling.

What this means

Information written into the memory file may persist across sessions and shape future agent behavior.

Why it was flagged

The guide creates a persistent memory directory and initializes MEMORY.md with sections for user information and preferences. This is aligned with agent setup, but it creates retained context that may influence future interactions.

Skill content
New-Item -ItemType Directory -Force -Path "$base\memory" | Out-Null
...
## 用户信息
(待填写)

## 偏好习惯
(待填写)
Recommendation

Only store information you are comfortable retaining, periodically review MEMORY.md, and avoid putting secrets or unnecessary personal data in agent memory.

What this means

Restarting the gateway could temporarily interrupt existing OpenClaw integrations or agents.

Why it was flagged

The skill includes user-run OpenClaw CLI commands that inspect and restart the local gateway. This is appropriate for connecting a new bot, but it changes local service state.

Skill content
openclaw gateway status
openclaw gateway restart
Recommendation

Run the gateway restart only when you are ready to apply the configuration, and verify existing agents or channels after restarting.