← 返回 Skills 市场

Feishu Send Message as App

Name: Feishu Send Message as App
Author: jkzleond

作者 jkzleond · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

177

总下载

当前安装

版本数

在 OpenClaw 中安装

/install feishu-send-message-as-app

功能描述

Send a Feishu IM message as the app (bot identity). Use when you need to send a message that appears to come from the bot/app, not the user. Uses App Access...

使用说明 (SKILL.md)

Feishu Send Message as App

Send a Feishu IM message with app/bot identity — not user identity.

Usage

bash \x3Cskill-dir>/scripts/send-message.sh \x3Creceive_id> \x3Cmsg_type> \x3Ccontent> [open_id|chat_id]

Examples

# Text message
bash \x3Cskill-dir>/scripts/send-message.sh ou_xxx text "Hello"

# Image message (use image_key from feishu-upload-image)
bash \x3Cskill-dir>/scripts/send-message.sh ou_xxx image '{"image_key":"img_v3_xxx"}'

# Post message (rich text)
bash \x3Cskill-dir>/scripts/send-message.sh ou_xxx post '{"zh_cn":{"title":"Title","content":[[{"tag":"text","text":"Hello"}]]}}'

# To a group chat
bash \x3Cskill-dir>/scripts/send-message.sh oc_xxx text "Hello" chat_id

Environment variables

export FEISHU_RECEIVE_ID="ou_xxx"
export FEISHU_MSG_TYPE="text"
export FEISHU_CONTENT="Hello"
bash \x3Cskill-dir>/scripts/send-message.sh

Workflow with feishu-upload-image

# 1. Upload image → get image_key
IMAGE_KEY=$(bash \x3Cfeishu-upload-image-dir>/scripts/upload-image.sh /path/to/image.png)

# 2. Send as app
bash \x3Cskill-dir>/scripts/send-message.sh ou_xxx image "{\"image_key\":\"$IMAGE_KEY\"}"

Output

message_id: om_xxxxxxxxxxxxxxxx

Credentials

Reads appId and appSecret from openclaw.json at channels.feishu.

安全使用建议

This skill's code does what it says (gets an app token and posts to Feishu), but the registry metadata fails to declare that it reads appId/appSecret from an openclaw.json file (default /root/.openclaw/openclaw.json). Before installing: (1) confirm where your Feishu app credentials are stored and whether you want this skill to read that file; (2) ensure the openclaw.json file permissions are restrictive and that you trust the skill's origin; (3) be aware the script caches the app token in /tmp (may be readable by other users on the host); (4) review the script locally to ensure it matches your expectations and consider testing in an isolated environment. If you need higher assurance, ask the publisher to update registry metadata to declare the required config path and to explain token caching behavior.

功能分析

Type: OpenClaw Skill Name: feishu-send-message-as-app Version: 1.0.0 The skill is a legitimate tool for sending Feishu messages via a bot identity. It retrieves credentials from a local configuration file (`/root/.openclaw/openclaw.json`) and communicates exclusively with official Feishu API endpoints (open.feishu.cn). No evidence of data exfiltration, malicious execution, or prompt injection was found in scripts/send-message.sh or SKILL.md.

能力评估

⚠ Purpose & Capability

The skill's purpose (send Feishu messages as the app) matches the included script. However the registry metadata declares no required credentials or config paths while SKILL.md and the script read appId and appSecret from openclaw.json (default /root/.openclaw/openclaw.json). The omission in metadata is an inconsistency that could hide sensitive file access.

⚠ Instruction Scope

SKILL.md and scripts instruct the agent to read credentials from openclaw.json, call Feishu API endpoints, and cache an app token in /tmp/feishu_app_token.cache. The instructions stay within the Feishu API domain, but they reference and read a local config file that was not declared in the registry, which expands scope beyond what's advertised.

✓ Install Mechanism

No install spec; this is an instruction-only skill with a small included shell script. Nothing is downloaded or written during install beyond the script itself.

⚠ Credentials

Registry lists no required environment variables or primary credential, yet the script requires appId/appSecret (read from openclaw.json) and supports optional FEISHU_* env vars for convenience. Requesting access to local stored credentials without declaring them is disproportionate to the metadata and should be justified.

✓ Persistence & Privilege

The skill is not marked always:true and does not modify other skills. It writes a cached app token to /tmp/feishu_app_token.cache (temporary, potentially world-readable) but otherwise does not request persistent elevated privileges.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install feishu-send-message-as-app
安装完成后，直接呼叫该 Skill 的名称或使用 /feishu-send-message-as-app 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: send Feishu IM messages with bot/app identity using App Access Token

元数据

Slug feishu-send-message-as-app

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题