← Back to Skills Marketplace
soraclub

Feishu Master

by guanzi@soraclub · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
263
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install feishu-master
Description
AI Tool Extension for Feishu API - A progressively extensible skill that enables AI tools (OpenClaw, Claude Code, etc.) to leverage Feishu capabilities on-de...
README (SKILL.md)

Feishu Skill - AI Tool Extension for Feishu API

A progressively extensible skill designed for AI tools to leverage Feishu capabilities. The core philosophy is implement only what you need, when you need it.

⚠️ CRITICAL: After Creating New Scripts

You MUST update scripts/script_index.json immediately after creating any new script.

Failure to update the index will cause:

  • Future AI lookup cannot find the newly created script
  • Duplicate implementation of the same functionality
  • Confusion for other AI tools using this skill

Action required: Add an entry to scripts/script_index.json with fields: name, description, usage_hint, added_date, tags

Design Philosophy

This skill is designed specifically for AI tools, not for human manual use.

When an AI tool receives a task involving Feishu:

  1. Check existing scripts first - Search scripts/script_index.json for already-implemented APIs
  2. Implement only if needed - If no match exists, use Context7 to query Feishu OpenAPI documentation
  3. Add to index - Once implemented, update the index to avoid future re-implementation

This approach ensures:

  • No wasted effort - Only implement APIs when actually needed
  • Progressive expansion - The skill grows based on real usage patterns
  • Efficient lookup - AI tools can quickly find what's already available

Quick Start

This skill works out of the box once authentication is configured:

# Configure authentication (one-time setup)
cd scripts/env
echo '{"app_id": "your_app_id", "app_secret": "your_app_secret"}' > app.json

AI Workflow

Decision Logic

When AI encounters a Feishu-related task, follow this decision tree:

Step 1: Check index file

Read scripts/script_index.json
Search by: description, tags

If match found:

  • Run python3 script.py --help to understand parameters
  • Execute the script
  • Return result

If NO match found:

  • Use Context7 to query Feishu API documentation:
    Library: open.feishu.cn / larksuite
    Query: "[specific requirement, e.g., 如何获取群组成员列表]"
    
  • Implement new Python script based on documentation
  • Execute and test
  • IMPORTANT: Update scripts/script_index.json to add the new script

If execution fails:

  • Check API error messages
  • Use Context7 or references/doc_urls.txt to consult documentation
  • Fix the script
  • Re-test

Critical Decision Points

When deciding between "use existing" vs "implement new", consider:

  • Is there a semantic match? Even if parameter names differ, if the functionality is equivalent, use existing script
  • What's the cost of implementing? Simple single-call APIs → implement immediately. Complex multi-call workflows → consider reusing existing scripts
  • Can this compose from existing scripts? Sometimes new features can be achieved by combining multiple existing scripts

Technical Reference

Script Index Format

scripts/script_index.json structure:

{
  "version": "1.0",
  "last_updated": "2026-02-12T12:00:00Z",
  "scripts": [
    {
      "name": "get_group_members",
      "description": "获取指定群组的人员列表",
      "usage_hint": "python3 get_group_members.py \x3Copen_chat_id>",
      "added_date": "2026-02-12",
      "tags": ["group", "member", "user"]
    }
  ]
}

Key fields for AI search:

  • description: Human-readable explanation of functionality
  • tags: Array of keywords for matching (prioritize these for fuzzy matching)

Authentication

Configuration file: scripts/env/app.json

{
  "app_id": "cli_xxxxxxxxxxxxxxxx",
  "app_secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

To obtain credentials:

  1. Login to Feishu Open Platform
  2. Create or select an application
  3. Get App ID and App Secret from application details

Token management: get_token.py handles token lifecycle:

  • Automatic caching during validity period
  • Auto-refresh 5 minutes before expiration
  • Cache file: scripts/env/token_cache.json

Script Template

When implementing new APIs, use this template:

#!/usr/bin/env python3
"""
[Complete functional description]

Usage:
    python3 script.py \x3Cparam1> \x3Cparam2> [options]

Parameters:
    param1: Parameter description
    param2: Parameter description

Options:
    --page-size: Page size (default: 20)
    --page-token: Pagination token

Output:
    JSON format output:
    {
      "code": 0,
      "msg": "success",
      "data": { ... }
    }

References:
    Feishu API: https://open.feishu.cn/document/...
"""

import sys
import json
import subprocess
from pathlib import Path
import requests

# Configuration
TOKEN_SCRIPT = Path(__file__).parent / "get_token.py"
BASE_URL = "https://open.feishu.cn"

def get_token():
    """Get Feishu access token"""
    result = subprocess.run(
        [sys.executable, str(TOKEN_SCRIPT)],
        capture_output=True,
        text=True,
        check=True
    )
    return result.stdout.strip()

def api_function(param1, param2, token, **kwargs):
    """API call function"""
    headers = {"Authorization": f"Bearer {token}"}
    # ... implement API call
    pass

def main():
    # Handle --help
    if "--help" in sys.argv or "-h" in sys.argv:
        print(__doc__)
        return

    # Parse required parameters
    if len(sys.argv) \x3C 3:
        print(__doc__, file=sys.stderr)
        sys.exit(1)

    param1 = sys.argv[1]
    param2 = sys.argv[2]
    kwargs = {}

    # Parse optional parameters
    for i in range(3, len(sys.argv)):
        if sys.argv[i].startswith("--"):
            key = sys.argv[i][2:].replace("-", "_")
            i += 1
            if i \x3C len(sys.argv):
                kwargs[key] = sys.argv[i]

    # Get token
    token = get_token()

    # Call API
    result = api_function(param1, param2, token, **kwargs)

    # Output JSON
    print(json.dumps(result, indent=2, ensure_ascii=False))

if __name__ == "__main__":
    main()

Development standards:

  1. ⚠️ CRITICAL: After creating any new script, you MUST update scripts/script_index.json immediately
  2. Complete docstring with Usage, Parameters, Options, Output sections
  3. Support --help parameter
  4. Use get_token.py for authentication
  5. Output standard JSON format
  6. Proper error handling with friendly messages

📋 New Script Creation Checklist

When implementing a new API, you MUST complete ALL steps:

  • Query Context7 for API documentation
  • Create the Python script following the template
  • Test the script execution (verify it returns correct JSON)
  • ⚠️ UPDATE scripts/script_index.json ← Don't forget this!
  • Save the API documentation URL to references/doc_urls.txt

Using Context7 for Feishu API

When implementing new APIs, query Feishu documentation via Context7:

Library ID: open.feishu.cn / larksuite
Query examples:
- "如何获取群组成员列表"
- "发送消息到飞书群组的 API 使用方法"
- "飞书文档操作的 OpenAPI"

Why Context7?

  • Provides up-to-date API documentation
  • Includes code examples and parameters
  • Faster than searching the web manually
  • Reduces trial-and-error

Examples

AI Task Example 1: Get Group Members

User request: "Get the member list for group oc_xxxxxxxxxxxxx"

AI decision process:

  1. Search scripts/script_index.json → Found match: get_group_members
  2. Execute: python3 scripts/get_group_members.py oc_xxxxxxxxxxxxx
  3. Return result

AI Task Example 2: Add New API Capability

User request: "Delete a message from the group"

AI decision process:

  1. Search scripts/script_index.json → No match
  2. Context7 query: "飞书删除消息 API"
  3. Get documentation showing message/delete endpoint
  4. Implement delete_message.py script
  5. Test execution
  6. ⛔ CRITICAL STEP: Update scripts/script_index.json with new entry - DO NOT skip this!
  7. Return result

Why step 6 is critical:

  • If you skip it, next AI will NOT find delete_message.py in the index
  • This causes duplicate work: same functionality will be re-implemented
  • The progressive expansion philosophy breaks down

References

Usage Guidance
This skill appears to do what it says: call Feishu APIs using local scripts. Before installing, do the following: (1) Inspect and keep the credentials file scripts/env/app.json private — do not commit it to source control. (2) Provide only a Feishu test app's app_id/app_secret if you want to limit blast radius. (3) Confirm you are comfortable allowing the agent to run the provided Python scripts (they call only Feishu endpoints and use subprocess to run get_token.py). (4) Ensure the requests library is installed in the runtime environment. (5) If you need the registry to document required secrets, consider requesting the publisher add a note that app.json (app_id/app_secret) is required. If you want stronger isolation, run these scripts in a constrained environment or with a test Feishu application.
Capability Analysis
Type: OpenClaw Skill Name: feishu-master Version: 1.0.0 The feishu-master skill bundle is classified as suspicious due to its 'progressively extensible' design, which explicitly instructs the AI agent in SKILL.md and DEVELOPMENT.md to dynamically generate, save, and execute new Python scripts at runtime. This architecture creates a significant risk of Remote Code Execution (RCE) via prompt injection, as the agent is directed to implement code based on external documentation (via 'Context7'). While the included scripts (get_token.py and get_group_members.py) appear to be legitimate tools for interacting with the Feishu API (open.feishu.cn), the core instruction set encourages the agent to bypass the safety of a static, audited codebase.
Capability Assessment
Purpose & Capability
The skill's name, description, SKILL.md and code all target Feishu APIs (token fetch, group member listing). One minor metadata mismatch: the registry lists no required credentials/environment variables, but the runtime requires a local config file (scripts/env/app.json) containing app_id and app_secret. Functionality requested by the skill (calling Feishu endpoints) matches its purpose.
Instruction Scope
SKILL.md explicitly instructs the agent to read scripts/script_index.json and scripts/env/app.json, to call get_token.py, and to implement/execute Python scripts that call Feishu endpoints. The instructions do not ask the agent to read unrelated system files or exfiltrate data to unexpected endpoints — all network calls target Feishu API endpoints and documentation references. The guidance to use Context7 to fetch documentation is a documentation/search step, not an exfiltration path.
Install Mechanism
This is essentially instruction+script package with no installer or remote download. Dependencies are limited to the requests Python library (requirements.txt). There is no archive download or third-party install URL, so install risk is low.
Credentials
The skill requires Feishu app credentials (app_id and app_secret) stored in scripts/env/app.json and manages a local token cache (token_cache.json). That is proportionate for a Feishu integration. Note: the registry metadata did not declare these credentials; instead the skill uses a local config file rather than environment variables. Users should be aware credentials will be written/read from the skill's scripts/env directory.
Persistence & Privilege
The skill does not request 'always: true' or any elevated platform privileges and does not modify other skills or system-wide agent settings. It runs standalone scripts and caches tokens in its own env/token_cache.json; this is limited in scope.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install feishu-master
  3. After installation, invoke the skill by name or use /feishu-master
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
init: 本技能用于按需扩展使用飞书的能力,基于飞书服务端API;依赖:context7(文档检索与示例参考)
Metadata
Slug feishu-master
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Feishu Master?

AI Tool Extension for Feishu API - A progressively extensible skill that enables AI tools (OpenClaw, Claude Code, etc.) to leverage Feishu capabilities on-de... It is an AI Agent Skill for Claude Code / OpenClaw, with 263 downloads so far.

How do I install Feishu Master?

Run "/install feishu-master" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Feishu Master free?

Yes, Feishu Master is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Feishu Master support?

Feishu Master is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Feishu Master?

It is built and maintained by guanzi@soraclub (@soraclub); the current version is v1.0.0.

💬 Comments