feishu-calendar

Manage Feishu (Lark) calendars by listing, searching, checking schedules, syncing events, and marking tasks with automated date extraction.

Install only if you are comfortable granting this skill Feishu calendar read/write/delete and sharing-management authority. Use least-privilege Feishu app credentials and a dedicated test calendar first, avoid running cleanup.js, setup_routine.js, or sync_routine.js without reviewing the target calendar and event list, and require explicit confirmation before any create, delete, recurring-event, attendee notification, or member-permission change.

Type: OpenClaw Skill Name: feishu-calendar Version: 1.0.0 The skill bundle is designed to manage Feishu calendars using the official SDK and standard practices. It accesses necessary API credentials from `.env` files and performs expected calendar operations. However, the `SKILL.md` file presents a significant prompt injection vulnerability. It instructs the AI agent to construct `node` commands using user-provided input (e.g., `--summary "Task: <Title>"`, `--desc "<Context>"`, `--attendees "<User_ID>"`). If the AI agent does not properly sanitize these user inputs before executing the commands, it could lead to shell injection or abuse of the Feishu API (e.g., creating spam events, inviting unauthorized users). While the code itself does not exhibit malicious intent (no data exfiltration to external domains, no persistence mechanisms outside of calendar events, no obfuscation), the explicit instruction to embed unsanitized user input into executable commands makes it suspicious due to the high risk of exploitation.