← 返回 Skills 市场
168
总下载
0
收藏
0
当前安装
4
版本数
在 OpenClaw 中安装
/install feishu-upload-image
功能描述
Upload a local image to Feishu and get its image_key. Use when you need to send an image via Feishu IM but first need the image_key returned by the upload AP...
使用说明 (SKILL.md)
Feishu Upload Image
Upload a local image file to Feishu and receive the image_key needed for sending via feishu_im_user_message.
只做一件事：本地文件 → image_key
Usage
bash \x3Cskill-dir>/scripts/upload-image.sh /path/to/image.png
Environment variables
export FEISHU_IMAGE_PATH="/path/to/image.png"
bash \x3Cskill-dir>/scripts/upload-image.sh
Output
img_v3_02104_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxg
Complete Workflow
# 1. Upload → get image_key
IMAGE_KEY=$(bash \x3Cskill-dir>/scripts/upload-image.sh /path/to/image.png)
# 2. Send via feishu_im_user_message tool (OpenClaw-native, user token auto-managed)
# action=send, msg_type=image, content="{\"image_key\":\"\x3CIMAGE_KEY>\"}"
Credentials
Reads appId and appSecret from openclaw.json at channels.feishu. Can be overridden with env vars FEISHU_APP_ID and FEISHU_APP_SECRET.
安全使用建议
This skill's functionality is straightforward, but there are a few red flags you should address before installing: (1) The script reads credentials from /root/.openclaw/openclaw.json by default — the registry metadata did not declare this config path. Verify that file only contains the expected Feishu credentials or instead set FEISHU_APP_ID and FEISHU_APP_SECRET in the environment. (2) The script requires curl and python3 but the skill metadata doesn't declare required binaries; ensure those binaries are available in the runtime. (3) The script caches an app token in /tmp; ensure that caching policy is acceptable in your environment. (4) Confirm the skill source and owner (no homepage/origin provided). If you proceed, run the script in a least-privileged environment (isolated container or dedicated runner), review the openclaw.json contents, and consider updating the skill metadata to declare the config path and primary credential so the requirement is explicit.
功能分析
Type: OpenClaw Skill
Name: feishu-upload-image
Version: 1.0.3
The skill is classified as suspicious because it performs high-risk actions such as reading sensitive credentials from '/root/.openclaw/openclaw.json' and making external network requests to the Feishu API. While these actions are aligned with the stated purpose in 'SKILL.md', the script 'scripts/upload-image.sh' contains a shell injection vulnerability in the 'get_cred' function where the 'OPENCLAW_JSON' environment variable is interpolated directly into a 'python3 -c' command. Additionally, it stores sensitive access tokens in a world-readable location ('/tmp/feishu_app_token.cache'), which is a risky security practice.
能力评估
Purpose & Capability
The skill's purpose (upload a local image to Feishu and return image_key) matches the script's behavior. However, the registry metadata declares no required config paths, env vars, or primary credential, while the SKILL.md and script read credentials from an OpenClaw config file (default /root/.openclaw/openclaw.json) or FEISHU_APP_ID/FEISHU_APP_SECRET. This mismatch between declared requirements and actual needs is incoherent.
Instruction Scope
SKILL.md and the script are narrowly scoped (local file -> Feishu image_key) and use only Feishu's API. But the instructions (and script) explicitly read a platform config file for credentials and cache an app token in /tmp. The SKILL.md does not declare the dependency on reading that config path, nor does it declare required binaries (curl, python3) that the script uses.
Install Mechanism
No install spec; this is an instruction-only skill with an included shell script. No packages are downloaded or extracted during install, so the install mechanism itself is low-risk.
Credentials
Requesting Feishu appId/appSecret is proportionate to the task. However: (1) the skill did not declare these as required credentials in metadata (no primary credential), (2) it reads the OpenClaw config file by default which may contain other sensitive data on the host, and (3) required binaries (python3, curl) are not declared. The use of a default path (/root/.openclaw/openclaw.json) is a surprise capability that increases the risk surface.
Persistence & Privilege
The skill is not always-enabled, does not modify other skills, and only writes a short-lived token cache to /tmp/feishu_app_token.cache. It does not request elevated or persistent system privileges.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install feishu-upload-image - 安装完成后，直接呼叫该 Skill 的名称或使用
/feishu-upload-image触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.3
Fix: remove hardcoded path; fix JSON escaping in example
v1.0.2
Fix: Credentials section no longer references non-existent skill
v1.0.1
Fix: credentials now read from openclaw.json, no hardcoded secrets
v1.0.0
Initial release: upload local image to Feishu and get image_key
元数据
常见问题
Feishu Upload Image 是什么？
Upload a local image to Feishu and get its image_key. Use when you need to send an image via Feishu IM but first need the image_key returned by the upload AP... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 168 次。
如何安装 Feishu Upload Image？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install feishu-upload-image」即可一键安装，无需额外配置。
Feishu Upload Image 是免费的吗？
是的，Feishu Upload Image 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Feishu Upload Image 支持哪些平台？
Feishu Upload Image 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Feishu Upload Image？
由 jkzleond（@jkzleond）开发并维护，当前版本 v1.0.3。
推荐 Skills