← Back to Skills Marketplace
Feishu Doc
by
autogame-17
· GitHub ↗
· v1.2.7
10386
Downloads
8
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install feishu-doc
Description
Fetch content from Feishu (Lark) Wiki, Docs, Sheets, and Bitable. Automatically resolves Wiki URLs to real entities and converts content to Markdown.
Usage Guidance
Review this package before installing. Use a separate least-privilege Feishu app, remove the cache directory and tenant-specific scripts, avoid running setup_iter11.js or inspect_meta.js, restrict token storage, and verify the external feishu-common/common modules before allowing the skill to access real tenant data.
Capability Analysis
Type: OpenClaw Skill
Name: feishu-doc
Version: 1.2.7
The skill is suspicious due to critical vulnerabilities in its authentication and file handling mechanisms. The `lib/auth.js` file loads environment variables from parent directories (e.g., `../../../.env`) and stores Feishu access tokens unencrypted in a shared cache file (`../../../memory/feishu_token.json`), posing a significant risk of credential exposure and token theft. Additionally, scripts like `append_simple.js` and `download_file.js` allow reading from and writing to arbitrary local file paths, which could be exploited by a compromised agent to access or modify sensitive system files. While the skill's core purpose of interacting with Feishu documents is benign, these vulnerabilities could enable malicious actions if exploited.
Capability Assessment
Credentials
The skill requires Feishu application credentials and can read or mutate Docs, Sheets, Bitable records, permissions, and local files; several included scripts exceed the minimum authority expected for a document conversion skill.
Install Mechanism
The package depends on ../feishu-common/index.js and ../common/env outside the audited artifact, while package.json does not declare all runtime imports; this makes authentication and network behavior depend on ambient sibling modules.
Instruction Scope
The main instructions disclose document writing, but do not clearly disclose hard-coded Bitable table selection, hard-coded tenant resource mutation, arbitrary local download destinations, or the private cached operational content shipped with the skill.
Persistence & Privilege
lib/auth.js writes a shared plaintext tenant access token to ../../../memory/feishu_token.json with default permissions, and cache files persist private Feishu content inside the distributed package.
Purpose & Capability
SKILL.md discloses Feishu read, create, write, append, and block operations, but the artifact also contains tenant-specific Bitable setup and inspection scripts, a hard-coded preferred Bitable table, an unrestricted IM file downloader, and bundled Feishu cache data that are not coherently scoped to the published purpose.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install feishu-doc - After installation, invoke the skill by name or use
/feishu-doc - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.7
Version 1.2.7 of feishu-doc
- No code or documentation changes detected in this release.
- All functionality and usage remain the same as the previous version.
v1.2.6
Re-publish after account restoration
Metadata
Frequently Asked Questions
What is Feishu Doc?
Fetch content from Feishu (Lark) Wiki, Docs, Sheets, and Bitable. Automatically resolves Wiki URLs to real entities and converts content to Markdown. It is an AI Agent Skill for Claude Code / OpenClaw, with 10386 downloads so far.
How do I install Feishu Doc?
Run "/install feishu-doc" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Feishu Doc free?
Yes, Feishu Doc is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Feishu Doc support?
Feishu Doc is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Feishu Doc?
It is built and maintained by autogame-17 (@autogame-17); the current version is v1.2.7.
More Skills