Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ali Feishu Sender
v1.0.0Send multimedia content to Feishu (Lark) via API. Use when: (1) sending images, audio, video, rich text, or cards to Feishu users/groups, (2) uploading media...
⭐ 0· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code implements Feishu media upload and messaging endpoints (images, audio→opus conversion, mp4 faststart, rich text, cards) which matches the skill description — functionality is coherent with the stated purpose. However the SKILL registry lists no required env vars/binaries while SKILL.md and the script expect Feishu credentials and ffmpeg/ffprobe (Windows path D:\ffmpeg\bin), which is an inconsistency.
Instruction Scope
Runtime instructions and the script focus on reading local media files, converting/inspecting them via ffmpeg/ffprobe, obtaining a tenant access token from Feishu, uploading files/images, and sending messages to Feishu APIs. There are no instructions to read unrelated system files, contact unexpected external endpoints, or exfiltrate data outside the Feishu APIs.
Install Mechanism
This is an instruction-only skill with a single Python script and no install spec, so nothing is downloaded or installed by the skill itself. That lowers install risk. The script expects external binaries (ffmpeg/ffprobe) to exist on the host.
Credentials
Registry metadata claims no required environment variables, but the script reads FEISHU_APP_ID, FEISHU_APP_SECRET, and FEISHU_OPEN_ID from the environment (and will call the token endpoint if no token is provided). The SKILL.md also expects ffmpeg/ffprobe at a specific Windows path. Requesting Feishu app credentials is reasonable for this purpose, but the registry should declare them. The mismatch is a practical and security concern (users may unknowingly provide credentials).
Persistence & Privilege
The skill does not request persistent/always-on privileges (always:false) and does not modify other skills or system-wide settings. It performs network calls only to documented Feishu API endpoints.
What to consider before installing
Before installing or using: 1) Don’t hand over Feishu app_id/app_secret unless you trust the skill — the script will use these to request a tenant token and then upload files to Feishu. Prefer supplying a short-lived token if possible. 2) Verify and, if needed, correct the ffmpeg/ffprobe paths — the code defaults to D:\ffmpeg\bin\ which is Windows-specific and may not exist; ffmpeg is required for audio/video conversion. 3) Note the registry metadata omits the env vars and binary dependencies declared in SKILL.md/code — ask the publisher to correct the manifest so required credentials and binaries are explicit. 4) Review the script in a safe environment (e.g., sandbox or isolated VM) with non-sensitive test files to confirm behavior. 5) Be aware the tool will read local media files and upload them to Feishu — do not use with private data unless you intend to store/send it to your Feishu tenant. 6) If you need higher assurance, request the publisher to (a) document exact env vars, (b) remove hard-coded paths or make them configurable, and (c) sign or publish the package from a known source so you can track updates.Like a lobster shell, security has layers — review code before you run it.
latestvk975e5rx7hvqb315nhmjpfg3jn83vvzc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.