Feishu (Lark) skill pack installer. Downloads and installs all Feishu integration skills for OpenClaw / EnClaws — including bot setup, docs, calendar, tasks,...

What to consider before installing: - Review credentials & backups: The code expects FEISHU_APP_ID/FEISHU_APP_SECRET or an OpenClaw config (~/.openclaw/openclaw.json). Back up your OpenClaw config before installing because some scripts (quick-setup) claim to write credentials there. - Inspect code that writes files: The installer will copy skill directories into ~/.openclaw or ~/.enclaws tenant paths and will persist per-user OAuth tokens under the installed feishu-auth/.tokens. If you don't want persistent tokens on the host, avoid installing or run in an isolated environment. - Be cautious about automatic auth flow: Several SKILL.md files instruct the agent to automatically execute auth commands and to not ask the user before sending auth links. Decide whether you trust the agent to perform these actions automatically. - Avoid accidental deletion: The installer removes the source repoDir on exit and deletes non-skill files in in-place mode. Run the installer from a disposable/extracted directory or use node install.js --target <explicit-path> so you control where files are copied and to avoid unintentional deletion of your working directory. - Test in a sandbox: If possible, run the installer in a VM or container first to verify behavior (where it writes files, what it modifies) before installing on a production machine. - Audit sensitive modules: If you plan to use these skills, review feishu-auth/token-utils.* and feishu-quick-setup code to confirm how tokens and credentials are stored/updated and ensure there are no unexpected network endpoints or telemetry. If you want, I can extract and summarise the parts of feishu-auth/token-utils and feishu-quick-setup to show precisely where credentials are read/written and what files they modify.

Type: OpenClaw Skill Name: feishu-skills Version: 1.0.0 The skill bundle is a comprehensive and well-architected Feishu (Lark) integration for OpenClaw. It implements secure OAuth Device Flow for per-user authorization, with tokens stored locally using AES-256-GCM encryption (feishu-auth/token-utils.js). A significant security feature is the use of 'DATA_WARNING' prefixes in text extraction and OCR outputs (extract.js, ocr.js) to prevent the AI agent from interpreting document content as system instructions (indirect prompt injection). While the extraction utility dynamically installs npm dependencies via execSync, the package names are hardcoded, and the behavior is consistent with the stated goal of providing a zero-config installation experience. All network communication is directed to official Feishu/Lark domains (feishu.cn, larksuite.com).