← 返回 Skills 市场
deadblue22

Feishu Comments

作者 deadblue · GitHub ↗ · v1.2.0 · MIT-0
cross-platform ⚠ suspicious
479
总下载
0
收藏
0
当前安装
4
版本数
在 OpenClaw 中安装
/install feishu-comments
功能描述
Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum...
使用说明 (SKILL.md)

Feishu Document Comments

Fetch comments from Feishu docx documents via the Drive Comment API.

Requirements

  • Feishu app credentials configured in ~/.openclaw/openclaw.json (reads appId and appSecret from channels.feishu)
  • System dependencies: curl, python3 (must be available on PATH)
  • Feishu app permission: docs:document.comment:read or drive:drive

Usage

Run the bundled script to get all comments on a document:

bash skills/feishu-comments/scripts/get_comments.sh \x3Cdoc_token>

To fetch specific comments by ID:

bash skills/feishu-comments/scripts/get_comments.sh \x3Cdoc_token> "id1,id2,id3"

Resolve skills/ paths relative to the workspace directory.

When to Use

  • After feishu_doc list_blocks shows comment_ids on blocks
  • When user asks to review or check comments on a document
  • During document collaboration review cycles

Output Format

Each comment shows:

  • Comment ID, status (Open/Resolved), scope (Global/Local)
  • Quoted text (for local/inline comments)
  • All replies with user ID and text content

Extracting doc_token

From URL https://xxx.feishu.cn/docx/ABC123def → doc_token = ABC123def

For wiki pages, first use feishu_wiki to get obj_token, then use that as the doc_token.

How It Works

The bundled shell script:

  1. Reads Feishu app credentials (appId, appSecret) from ~/.openclaw/openclaw.json
  2. Obtains a tenant_access_token via the Feishu auth API
  3. Calls the Drive Comment API to list and batch-query comments
  4. Formats and outputs comment content to stdout

No data is sent to any third party beyond the Feishu/Lark API endpoints.

Limitations

  • Read-only (cannot create or reply to comments)
  • API error responses are printed to stderr (may contain request IDs but no sensitive data)
安全使用建议
Before installing: review the two bundled scripts (get_comments.sh and resolve_comments.sh). They read your OpenClaw config at ~/.openclaw/openclaw.json to extract appId/appSecret and may call Feishu/Lark APIs to list or close comments. Confirm that you trust the skill owner and that ~/.openclaw/openclaw.json contains only the expected Feishu channel credentials. Be aware the resolve script will modify comments (auto-resolve orphaned or specified comment IDs) — test in a safe document or with a limited-permission Feishu app first. The registry metadata should have declared these requirements (credentials and curl/python3); the omission is likely an oversight but is a transparency risk. If you need higher assurance, request the author to (1) declare required credentials/binaries in metadata, (2) document exactly what is read from the config file, or (3) offer an option to pass credentials via a dedicated, minimal config or environment variables rather than reading your home config.
功能分析
Type: OpenClaw Skill Name: feishu-comments Version: 1.2.0 The skill bundle contains a code injection vulnerability in `scripts/get_comments.sh`, where document content (`DOC_CONTENT`) is directly interpolated into a Python script string (`'''${DOC_CONTENT}'''`). This could allow a malicious document to execute arbitrary Python code on the agent's system. While the scripts' primary functions (fetching and resolving Feishu comments) align with the stated purpose and use legitimate Feishu/Lark API endpoints, the insecure handling of external data and the direct access to sensitive credentials in `~/.openclaw/openclaw.json` present a significant security risk.
能力评估
ℹ Purpose & Capability
Name/description (fetching and resolving Feishu doc comments) aligns with the included scripts which call Feishu/Lark APIs and use appId/appSecret. However the skill metadata did not declare the need for Feishu credentials or system binaries, so the declared requirements do not fully reflect what the skill actually needs.
⚠ Instruction Scope
SKILL.md and the scripts explicitly instruct the agent to read ~/.openclaw/openclaw.json for appId/appSecret and domain, obtain a tenant_access_token, and call Feishu drive/docx APIs. Reading a user-local config file in the home directory is outside what the registry metadata declared and could expose other local configuration if the file contents differ from expectations.
✓ Install Mechanism
No install spec — instruction-only with bundled scripts. No remote downloads or package installs are present, which keeps install risk low.
⚠ Credentials
The scripts require Feishu app credentials (appId/appSecret) and system binaries (curl, python3) but the skill metadata lists no required env vars or binaries. The missing declaration is a proportionality / transparency problem: the skill legitimately needs Feishu credentials for its purpose, but that need should be declared so users understand what they must provide and what will be accessed.
✓ Persistence & Privilege
always is false and the skill does not request system-wide persistence or modify other skills' configs. It performs API calls and (optionally) patches comments via Feishu APIs, which is within its stated scope.
如何使用
  1. 确保已安装 OpenClaw（本地或 Docker 部署）
  2. 在对话框中输入安装命令：/install feishu-comments
  3. 安装完成后，直接呼叫该 Skill 的名称或使用 /feishu-comments 触发
  4. 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.2.0
Added orphan comment detection (marks comments whose anchor text no longer exists in document as 👻 Orphaned). Default now filters to Open + anchored comments only; use --all flag to include orphaned and resolved. Added summary statistics line.
v1.1.0
Sync with latest version
v1.0.1
Fix security review: declare config file access, system dependencies (curl/python3), and credential usage in SKILL.md
v1.0.0
Initial release: read comments from Feishu docx documents via Drive Comment API
元数据
Slug feishu-comments
版本 1.2.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 4
常见问题

Feishu Comments 是什么？

Read comments from Feishu documents. Use when: user asks to check/read/fetch comments on a Feishu doc, review feedback on a document, or collaborate on docum... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 479 次。

如何安装 Feishu Comments？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install feishu-comments」即可一键安装，无需额外配置。

Feishu Comments 是免费的吗？

是的，Feishu Comments 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Feishu Comments 支持哪些平台？

Feishu Comments 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Feishu Comments？

由 deadblue（@deadblue22）开发并维护，当前版本 v1.2.0。

推荐 Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191113 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 留言讨论