auto-file-sender

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent and disclosed for sending workspace files to Feishu/Lark, but users should carefully control which files and recipients are used because it supports automatic and batch file delivery.

Install only if you want the agent to help send workspace files to Feishu/Lark. Use narrow file patterns, confirm recipient open_ids, and avoid running broad automatic watch mode on directories that may contain private or unintended files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the user or agent chooses the wrong file path or recipient, unintended files could be sent to the wrong Feishu/Lark user or chat.

Why it was flagged

The skill instructs the agent to send local files through a messaging tool to a Feishu/Lark recipient. This is the intended function, but it is a sensitive tool action because it transfers workspace files externally.

Skill content
"filePath": "<absolute-path-to-file>", ... "target": "<recipient-open-id>"
Recommendation

Use explicit file paths, file patterns, and recipient IDs; review the file list before batch or automatic sending.

What this means

Files sent through this skill may become accessible in Feishu/Lark according to the recipient, chat, and workspace permissions.

Why it was flagged

The skill sends files to an external collaboration provider. This is disclosed and purpose-aligned, but users should understand that selected workspace files leave the local environment.

Skill content
Send via Feishu message with file attachment
Recommendation

Confirm the destination user or chat and avoid sending sensitive files unless that external sharing is intended.

What this means

While running, it may keep detecting newly created matching files and producing send commands for them.

Why it was flagged

The helper can continuously watch a directory for matching files. It does not install persistence or send files by itself, but it is a long-running workflow users should intentionally start and stop.

Skill content
while True: ... files = scan_directory(directory, pattern) ... log("Press Ctrl+C to stop")
Recommendation

Run watch mode only for the needed task, restrict the watched directory and pattern, and stop it when automatic delivery is no longer desired.