Feishu Card

Send rich interactive Feishu cards with markdown, headers, buttons, images, and styled persona messages to users or groups.

Install only after hardening or running it in an isolated environment. Replace execSync command strings with spawn/execFile argument arrays or direct function calls, validate target/title/color/event fields, remove or clearly disclose smart path inference for --text, and reapply secret scanning before every outbound fallback. Use a least-privilege Feishu app token and avoid sending secrets, logs, code, or regulated data through this skill unless you intend that content to reach Feishu/Lark.

Type: OpenClaw Skill Name: feishu-card Version: 1.4.11 The skill is classified as suspicious due to critical shell injection vulnerabilities in `handle_event.js` and `send_safe.js`. In `handle_event.js`, the `eventPayload.event.event_key` (untrusted input) is directly embedded into an `execSync` command, allowing arbitrary command execution. Similarly, `send_safe.js`, despite its name, directly interpolates `options.title` (user input) into an `execSync` command, bypassing any intended sanitization for other arguments. Additionally, `send.js` contains a 'Smart Input' feature that could lead to local file disclosure if an attacker can control the `--text` argument to point to sensitive files. While the `send.js` file includes a `scanForSecrets` function, which is a positive security feature, it does not mitigate these RCE or file disclosure risks.