飞书群聊机器人

AdvisoryAudited by Static analysis on May 12, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken or overly broad request could cause messages, reminders, or announcements to be sent to the wrong group or many groups.

Why it was flagged

The skill gives the agent broad authority to send scheduled, conditional, multi-group, and batch Feishu notifications, but the instructions do not require explicit recipient scoping, message preview, or confirmation before high-impact posts.

Skill content
支持定时发送、条件触发、多群管理。当用户需要通过飞书群进行团队沟通自动化、设置群消息机器人、批量群发通知时使用。
Recommendation

Require explicit group selection, content preview, and user confirmation before sending or scheduling messages, especially for batch or multi-group notifications.

ConcernHigh Confidence
ASI10: Rogue Agents
What this means

The bot may continue sending reminders or automatic replies after the user has forgotten about them or after the context has changed.

Why it was flagged

Scheduled tasks and auto-reply behavior can persist beyond a single user interaction, but the artifacts do not describe how users can view, pause, expire, or delete those automations.

Skill content
支持定时任务调度
Recommendation

Document and enforce lifecycle controls: list active automations, require an owner, set expiration defaults, provide cancellation commands, and log scheduled sends.

What this means

Users may not know which Feishu account, bot identity, groups, or workspace permissions the skill will use.

Why it was flagged

Using the Feishu chat API implies delegated Feishu workspace permissions, while the supplied metadata does not describe a credential or scope model.

Skill content
基于 OpenClaw feishu_chat API
Recommendation

Before use, confirm the Feishu authorization method, bot identity, allowed groups, and minimum required scopes.