← Back to Skills Marketplace

Feishu Comments

Name: Feishu Comments
Author: deadblue22

by deadblue · GitHub ↗ · v1.2.0 · MIT-0

cross-platform ⚠ suspicious

479

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install feishu-comments

Description

Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum...

README (SKILL.md)

Feishu Document Comments

Fetch comments from Feishu docx documents via the Drive Comment API.

Requirements

Feishu app credentials configured in ~/.openclaw/openclaw.json (reads appId and appSecret from channels.feishu)
System dependencies: curl, python3 (must be available on PATH)
Feishu app permission: docs:document.comment:read or drive:drive

Usage

Run the bundled script to get all comments on a document:

bash skills/feishu-comments/scripts/get_comments.sh \x3Cdoc_token>

To fetch specific comments by ID:

bash skills/feishu-comments/scripts/get_comments.sh \x3Cdoc_token> "id1,id2,id3"

Resolve skills/ paths relative to the workspace directory.

When to Use

After feishu_doc list_blocks shows comment_ids on blocks
When user asks to review or check comments on a document
During document collaboration review cycles

Output Format

Each comment shows:

Comment ID, status (Open/Resolved), scope (Global/Local)
Quoted text (for local/inline comments)
All replies with user ID and text content

Extracting doc_token

From URL https://xxx.feishu.cn/docx/ABC123def → doc_token = ABC123def

For wiki pages, first use feishu_wiki to get obj_token, then use that as the doc_token.

How It Works

The bundled shell script:

Reads Feishu app credentials (appId, appSecret) from ~/.openclaw/openclaw.json
Obtains a tenant_access_token via the Feishu auth API
Calls the Drive Comment API to list and batch-query comments
Formats and outputs comment content to stdout

No data is sent to any third party beyond the Feishu/Lark API endpoints.

Limitations

Read-only (cannot create or reply to comments)
API error responses are printed to stderr (may contain request IDs but no sensitive data)

Usage Guidance

Before installing: review the two bundled scripts (get_comments.sh and resolve_comments.sh). They read your OpenClaw config at ~/.openclaw/openclaw.json to extract appId/appSecret and may call Feishu/Lark APIs to list or close comments. Confirm that you trust the skill owner and that ~/.openclaw/openclaw.json contains only the expected Feishu channel credentials. Be aware the resolve script will modify comments (auto-resolve orphaned or specified comment IDs) — test in a safe document or with a limited-permission Feishu app first. The registry metadata should have declared these requirements (credentials and curl/python3); the omission is likely an oversight but is a transparency risk. If you need higher assurance, request the author to (1) declare required credentials/binaries in metadata, (2) document exactly what is read from the config file, or (3) offer an option to pass credentials via a dedicated, minimal config or environment variables rather than reading your home config.

Capability Analysis

Type: OpenClaw Skill Name: feishu-comments Version: 1.2.0 The skill bundle contains a code injection vulnerability in `scripts/get_comments.sh`, where document content (`DOC_CONTENT`) is directly interpolated into a Python script string (`'''${DOC_CONTENT}'''`). This could allow a malicious document to execute arbitrary Python code on the agent's system. While the scripts' primary functions (fetching and resolving Feishu comments) align with the stated purpose and use legitimate Feishu/Lark API endpoints, the insecure handling of external data and the direct access to sensitive credentials in `~/.openclaw/openclaw.json` present a significant security risk.

Capability Assessment

ℹ Purpose & Capability

Name/description (fetching and resolving Feishu doc comments) aligns with the included scripts which call Feishu/Lark APIs and use appId/appSecret. However the skill metadata did not declare the need for Feishu credentials or system binaries, so the declared requirements do not fully reflect what the skill actually needs.

⚠ Instruction Scope

SKILL.md and the scripts explicitly instruct the agent to read ~/.openclaw/openclaw.json for appId/appSecret and domain, obtain a tenant_access_token, and call Feishu drive/docx APIs. Reading a user-local config file in the home directory is outside what the registry metadata declared and could expose other local configuration if the file contents differ from expectations.

✓ Install Mechanism

No install spec — instruction-only with bundled scripts. No remote downloads or package installs are present, which keeps install risk low.

⚠ Credentials

The scripts require Feishu app credentials (appId/appSecret) and system binaries (curl, python3) but the skill metadata lists no required env vars or binaries. The missing declaration is a proportionality / transparency problem: the skill legitimately needs Feishu credentials for its purpose, but that need should be declared so users understand what they must provide and what will be accessed.

✓ Persistence & Privilege

always is false and the skill does not request system-wide persistence or modify other skills' configs. It performs API calls and (optionally) patches comments via Feishu APIs, which is within its stated scope.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install feishu-comments
After installation, invoke the skill by name or use /feishu-comments
Provide required inputs per the skill's parameter spec and get structured output

Version History

v1.2.0

Added orphan comment detection (marks comments whose anchor text no longer exists in document as 👻 Orphaned). Default now filters to Open + anchored comments only; use --all flag to include orphaned and resolved. Added summary statistics line.

v1.1.0

Sync with latest version

v1.0.1

Fix security review: declare config file access, system dependencies (curl/python3), and credential usage in SKILL.md

v1.0.0

Initial release: read comments from Feishu docx documents via Drive Comment API

Metadata

Slug feishu-comments

Version 1.2.0

License MIT-0

All-time Installs 0

Active Installs 0

Total Versions 4

Frequently Asked Questions

What is Feishu Comments?

Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum... It is an AI Agent Skill for Claude Code / OpenClaw, with 479 downloads so far.

How do I install Feishu Comments?

Run "/install feishu-comments" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Feishu Comments free?

Yes, Feishu Comments is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Feishu Comments support?

Feishu Comments is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Feishu Comments?

It is built and maintained by deadblue (@deadblue22); the current version is v1.2.0.

More Skills