飞书高阶构建器。提供飞书基础原生工具之外的深度结构化能力，包括：原生画板（Mermaid/PlantUML）一键生成并嵌入、多维表格（Bitable）精准行列级数据操控、以及超复杂 Markdown 到飞书原生 Block 树的无损转化。适用于研发 DevOps 流转、架构图自动绘制及重度排版文档生成。

Key points before you install/use this skill: - Origin verification: The skill's Source/Homepage are unknown. Only install if you trust the publisher or can host/inspect the code yourself. - Credentials: The scripts require FEISHU_APP_ID and FEISHU_APP_SECRET even though registry metadata didn't declare them — do not provide tenant-wide admin credentials unless you understand scope. Prefer creating an app with minimal write scopes and test in a non-production tenant. - Dependency & runtime: The bundled Node scripts reference 'feishu-markdown' and rely on fetch being available. The skill provides no install instructions; you'll likely need to install npm packages manually. Review and vendor dependencies before running to avoid pulling malicious packages. - Token leakage: The scripts log tokens and API responses to stdout. Ensure logs are not sent to external log aggregators or shared channels, or modify the code to avoid printing tokens. - File access: The tools accept arbitrary local file paths (markdown, code). Only run them with files you intend to expose and avoid running them with elevated privileges or in directories containing secrets. - Recommended actions: If you want to use this, fetch the repository, review the three scripts and their dependencies, run them in an isolated environment (ephemeral container) with a least-privilege Feishu app, and consider adding explicit documentation or an install script that pins dependencies and documents the exact env vars used (including FEISHU_BASE_URL). If you cannot validate the source, treat it as untrusted code and do not provide production credentials.

Type: OpenClaw Skill Name: feishu-advanced-builder Version: 1.0.1 The skill bundle is classified as suspicious due to a local file inclusion (LFI) vulnerability present in all three primary JavaScript scripts (`scripts/feishu-bitable.js`, `scripts/feishu-board.js`, `scripts/feishu-markdown-to-docx.js`). Each script uses `fs.readFileSync` to read content from a file path provided as a command-line argument (`--markdown-file` or `--code-file`). An attacker could exploit this by injecting a malicious file path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) via prompt injection to the OpenClaw agent, leading to arbitrary file disclosure. While the scripts then attempt to process this content and send it to the Feishu API (the intended destination for the skill's output), the ability to read arbitrary local files constitutes a significant security vulnerability.