send image in feishu

Send images inline in Feishu chat by uploading via API to get image_key, then sending image message using receive_id_type in URL query.

This skill will create and execute a temporary Node.js script and read your local openclaw.json to get app credentials, yet it declares no required binaries or credentials and even includes a hardcoded appSecret in the instructions. Before installing or using it: (1) Do NOT trust or reuse the hardcoded appSecret — treat it as a leaked secret and rotate it immediately if it is real. (2) Require the author to explicitly declare that node is required and to move credentials to secure env vars or a secrets manager rather than reading global config files. (3) Prefer a version that asks for appId/appSecret at runtime or uses an official SDK instead of writing/executing ad-hoc scripts. (4) If you must run it, run in an isolated environment, audit the generated script before execution, and restrict the Feishu app’s permissions. (5) Ask the publisher why openclaw.json must be read and request they remove the embedded secret from SKILL.md.

Type: OpenClaw Skill Name: send-feishu-image Version: 1.0.0 The skill bundle contains a hardcoded sensitive credential (`appSecret`: `Q3c78ab1ORB7xOj0JtRz2d1GwQtzZcZH`) within the `SKILL.md` file, which constitutes a significant security risk and credential leak. Furthermore, the instructions direct the AI agent to bypass standard tool constraints by generating and executing arbitrary Node.js scripts from the `/tmp` directory. While these patterns are highly risky and represent poor security practice, they appear functionally aligned with the stated goal of resolving Feishu image rendering issues rather than demonstrating clear intent for data exfiltration or system compromise.