Feishu PDF Uploader

飞书PDF文件上传器 - 将本地PDF文件上传到飞书云盘。 使用飞书OpenAPI的upload_prepare → upload_part → upload_finish流程， 支持大文件分片上传。 Use when uploading PDF or any files to Feishu (Lark) clo...

Security Scan

The skill's code and instructions consistently implement a Feishu (Lark) file uploader and only request access to Feishu credentials stored in the user's OpenClaw config or optional FEISHU_* env vars.

Purpose & Capability

Overall coherent: name/description (upload files to Feishu cloud drive) match the code (calls open.feishu.cn APIs to prepare/upload/finish). Minor mismatch: skill.yaml and README mention features like "批量上传、自动分类、权限设置" (batch upload, auto-classification, permission setting) that are not implemented in the provided code — this is an overstatement but not malicious.

Instruction Scope

SKILL.md and the scripts instruct only to read Feishu credentials from ~/.openclaw/openclaw.json or environment variables and to POST file data to Feishu's official API endpoints. The runtime instructions and code do not access unrelated system files, do not call external endpoints other than open.feishu.cn, and do not perform broad data collection.

Install Mechanism

No install spec; code is instruction-only and included in the package. Required binaries (python3 and requests) are appropriate and minimal. There are no downloads from third-party URLs or archive extraction steps.

Credentials

Requested configuration access (channels.feishu.accounts in ~/.openclaw/openclaw.json) and optional env vars (FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_FOLDER_TOKEN) are proportionate to the stated purpose of obtaining tenant tokens and uploading files. No unrelated credentials or broad secrets are requested.

Persistence & Privilege

The skill is not always-enabled, does not modify other skills or system-wide settings, and only reads the user's OpenClaw config for credentials. It does not persist new credentials or attempt privilege escalation.

Assessment

This skill appears to do what it says: upload files to Feishu using app_id/app_secret from your OpenClaw config or environment variables. Before installing: (1) Verify you trust the skill source and inspect the included Python files if you have sensitive environments. (2) Ensure your ~/.openclaw/openclaw.json only contains the Feishu credentials you intend to use. (3) Note that some README claims (batch upload, auto-classification, permission management) are not implemented in the provided code. (4) Run the tool in a controlled environment the first time (or with network access limited) if you want to observe behavior before using it with production credentials.

Feishu PDF Uploader | 飞书PDF上传器

上传本地PDF文件到飞书云盘。支持任意文件类型，不仅限于PDF。

Upload local PDF files (or any files) to Feishu (Lark) cloud drive.

快速开始 | Quick Start

python3 scripts/upload_pdf.py /path/to/file.pdf --folder-token FOLDER_TOKEN

使用方法 | Usage

命令行

python3 scripts/upload_pdf.py <file_path> [options]

Options:
  --folder-token    目标文件夹token (默认从环境变量读取)
  --app-id          飞书应用ID (默认从config读取)
  --app-secret      飞书应用密钥 (默认从config读取)

Python API

from upload_pdf import upload_file_to_feishu

result = upload_file_to_feishu(
    file_path="/path/to/file.pdf",
    folder_token="VnTdf2MNglfgPtdrhCxcSTdOnZd",
    app_id="cli_xxx",
    app_secret="xxx"
)
# Returns: {"success": True, "file_token": "...", "url": "..."}

工作原理 | How It Works

1. Prepare - 调用 /drive/v1/files/upload_prepare 获取 upload_id
2. Upload - 调用 /drive/v1/files/upload_part 上传文件内容
3. Finish - 调用 /drive/v1/files/upload_finish 完成上传

关键技术点

⚠️ 重要：upload_part接口不需要 checksum 参数！

正确参数：

• upload_id - 从prepare获取
• seq - 分片序号（从0开始）
• size - 文件大小（字节）
• file - 文件内容（multipart/form-data）

❌ 错误：添加checksum参数 → 返回 1061002 params error ✅ 正确：只传upload_id/seq/size/file → 上传成功

配置 | Configuration

从OpenClaw配置自动读取：

• channels.feishu.accounts[].appId
• channels.feishu.accounts[].appSecret

错误处理 | Error Handling

错误码	原因	解决
1061002	params error	移除checksum参数
1062008	checksum param Invalid	不要传checksum
1061021	upload id expire	重新调用prepare

使用场景 | Use Cases

• 上传投资报告PDF到飞书云盘
• 备份生成的文档到云端
• 批量文件上传自动化

安全说明 | Security

凭证仅用于获取tenant access token并上传文件。不会存储或传输到其他地方。