Feishu Proactive Messenger

• Analyzed: May 11, 2026, 4:48 AM
• Findings: 1
• Version: 1.0.1
• Hash: 569ff26bdb9225eba2d2e34436a8fa5a9881f8cebfe04e4ec5846f14596dd14c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'feishu-proactive-messenger' is designed to send proactive text messages via the Feishu OpenAPI. The Python script (`scripts/feishu_proactive_messenger.py`) correctly implements this functionality by reading Feishu credentials (appId/appSecret) from `~/.openclaw/openclaw.json` and using them exclusively to obtain a tenant access token and interact with legitimate Feishu API endpoints (open.feishu.cn). There is no evidence of credential exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in the documentation. All actions align with the stated purpose and security declarations.