Feishu Card

飞书互动卡片发送技能（国际版 Feishu 兼容）。当需要发送格式丰富的飞书卡片消息时使用。支持标题、Markdown 内容、颜色主题。关键：必须使用 schema 2.0 格式 + 双重 JSON stringify，否则国际版飞书（Feishu）无法渲染。

This skill appears to do what it claims (construct and send Feishu schema 2.0 interactive cards), but it reads your OpenClaw configuration file (~/.openclaw/openclaw.json) to obtain the Feishu app_secret while the registry metadata declares no required credentials — that's an inconsistency you should address before installing. Recommended actions: 1) Inspect the file ~/.openclaw/openclaw.json to see what secrets it contains and whether you are comfortable the skill can read it. 2) Avoid running the curl example that uses cat to inject the secret into a shell variable (it can leak to logs or process listings); instead supply secrets via a safer mechanism (read-only file with strict permissions or an explicitly declared environment variable). 3) If you do not want the skill to read your OpenClaw config, modify the script to accept APP_SECRET via an environment variable or CLI argument and run it in a restricted account. 4) Verify the hard-coded APP_ID is expected for your environment. 5) If you need stronger assurance, request the author to update skill metadata to declare the required config path/credential and to remove any examples that expose secrets in shell history or logs.

Type: OpenClaw Skill Name: xiaolongxia-feishu-card Version: 1.0.0 The skill bundle is classified as suspicious because it explicitly instructs the AI agent and the included Python script (scripts/send_card.py) to read sensitive credentials (appSecret) from a global configuration file (/root/.openclaw/openclaw.json). While the script uses these credentials to interact with the legitimate Feishu API (open.feishu.cn), the practice of accessing a broad configuration file that may contain other platform secrets, combined with a hardcoded APP_ID (cli_a9f5877b3378dbd8), represents a high-risk pattern for credential exposure.