Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feishu Webhook
v1.2.4Send rich text messages to Feishu via Webhook with heredoc input support. Use when you need to send Markdown-formatted messages to Feishu channels or DMs, es...
⭐ 0· 1.4k·14 current·14 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name/description match the included script: the bundled Python script reads FEISHU_WEBHOOK_URL and FEISHU_WEBHOOK_SECRET from environment and POSTs a Feishu card payload. However the registry metadata lists no required env vars or primary credential despite the script and SKILL.md/README instructing users to set FEISHU_WEBHOOK_URL and FEISHU_WEBHOOK_SECRET. This mismatch is unexpected but functionally the capability itself is coherent.
Instruction Scope
SKILL.md instructs using heredoc input and configuring two environment variables in OpenClaw config. The runtime instructions and script only read stdin and the two env vars, and send a single HTTPS POST to the Feishu webhook host. The instructions do not ask the agent to read other files, scan system state, or exfiltrate to other endpoints.
Install Mechanism
No install spec — instruction-only with a small included Python script. Nothing is downloaded from arbitrary URLs or installed automatically, so there is low install risk.
Credentials
The script legitimately needs FEISHU_WEBHOOK_URL (and optionally FEISHU_WEBHOOK_SECRET) to function, but the skill metadata declares no required env vars or primary credential. Requiring secret-like env vars without declaring them in the registry is an inconsistency that could cause confusion and indicates metadata is incomplete. The secrets requested are proportionate to the stated purpose, but you should treat them as sensitive and only provide values for trusted skills.
Persistence & Privilege
Skill does not request persistent/always-on privileges (always: false). It does not modify other skills or system settings and has no install-time hooks, so persistence/privilege concerns are minimal.
What to consider before installing
This skill's code and README show it needs two env vars (FEISHU_WEBHOOK_URL and FEISHU_WEBHOOK_SECRET) even though the registry metadata didn't list them. Before installing: 1) Confirm you trust the skill source (homepage points to a GitHub repo). 2) Only populate FEISHU_WEBHOOK_URL/SECRET with non-sensitive test values first, and test sending non-confidential content. 3) Review the included scripts/send-feishu.py yourself (it is short) — it only reads stdin and the two env vars and POSTs to the Feishu host, so there is no hidden exfiltration in the repo. 4) Consider running the skill in an isolated environment if you are unsure. 5) If you plan to enable it widely, ask the maintainer to correct the registry metadata to declare the required env vars and primary credential so policy/consent UI is accurate.Like a lobster shell, security has layers — review code before you run it.
latestvk97fb8r3g44m5r879m76w8qsqs82tnpm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.