FeishuBitable-Plus

This package appears to implement what it claims (a local CLI + intent engine + Feishu API client). Before installing or using it, consider the following: - Credential handling: the code stores your App ID/App Secret in ~/.feishu-bitable-plus/credentials.json using Base64 encoding, which is reversible and not secure. Treat these files as sensitive, delete them when not in use, or modify the code to use a secure key store (e.g., keytar/system keychain). - Documentation mismatch: README/CLI messages imply system keychain storage; in reality the implementation uses file storage. If you require true system keychain support, patch or request that feature. - Source provenance: registry metadata lists source/homepage as unknown/none while package.json and README reference a GitHub repo. Prefer installing code from a verified source (inspect the GitHub repo/commit history) and confirm the package integrity. - Network behavior: the client talks only to open.feishu.cn (Feishu Open API) and obtains a tenant_access_token using your App ID/Secret—this is expected. If you want to be extra cautious, run the CLI in a network-monitored or sandboxed environment the first time. - Principle of least privilege: only grant the Feishu app the minimal scopes it needs and rotate credentials if you stop using the tool. If you rely on strong credential protection for production use, do not use the default ConfigManager as-is; replace with secure keychain storage or encrypt the credentials with a secret only you control.