Feishu Doc

Fetch content from Feishu (Lark) Wiki, Docs, Sheets, and Bitable. Automatically resolves Wiki URLs to real entities and converts content to Markdown.

Install only if you intend to grant this skill write-capable Feishu credentials, not just read access. Review and preferably remove or isolate helper scripts for permission grants, IM file downloads, hard-coded Bitable setup, and bundled cache files; use least-privilege Feishu app scopes and avoid shared on-disk token storage where possible.

Type: OpenClaw Skill Name: feishu-doc Version: 1.2.7 The skill is suspicious due to critical vulnerabilities in its authentication and file handling mechanisms. The `lib/auth.js` file loads environment variables from parent directories (e.g., `../../../.env`) and stores Feishu access tokens unencrypted in a shared cache file (`../../../memory/feishu_token.json`), posing a significant risk of credential exposure and token theft. Additionally, scripts like `append_simple.js` and `download_file.js` allow reading from and writing to arbitrary local file paths, which could be exploited by a compromised agent to access or modify sensitive system files. While the skill's core purpose of interacting with Feishu documents is benign, these vulnerabilities could enable malicious actions if exploited.