Feishu Group Ops

• Analyzed: May 11, 2026, 5:57 AM
• Findings: 1
• Version: 1.0.1
• Hash: 4ed4b8fb6906a0c876a344c13906de26351cc803c45f5bcd15fc43c055fb7b19
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires access to sensitive local configuration files (~/.openclaw/openclaw.json) to extract Feishu App IDs and Secrets. It implements a non-standard third-party billing mechanism via 'skillpay.me', which involves sending user identifiers to an external endpoint for every 'write' operation. Furthermore, scripts/feishu.py contains a hardcoded API key and a significant syntax/indentation error in the _skillpay_headers function that would cause the script to crash during authenticated requests to the billing service, indicating either poor code quality or an untested payment gate.