Official Feishu Toolkit

飞书开放平台全面集成工具包。支持日历与会议室预约、消息发送、审批流程、多维表格操作、通讯录查询和考勤管理六大核心办公模块。

What to check before installing: - Do NOT run curl https://backend.clawd.org.cn/... | sh without review. That command downloads and executes an external script from an unknown host—inspect the script contents and verify its source first. - Verify the 'uv' brew formula: confirm which tap provides it and inspect the formula contents. 'uv' is not a common system dependency for Python/uvicorn, so confirm it's legitimate for your environment. - The skill will get FEISHU_APP_ID and FEISHU_APP_SECRET; those credentials let the app obtain tenant_access_token and perform all API actions listed (send messages, read contacts, manage approvals, attendance, bitable, calendar). Only grant the minimum permissions needed in the Feishu developer console and consider using a dedicated test app/tenant first. - If you want lower risk, install from the included source files directly: create a Python virtualenv, pip install the package dependencies from pyproject.toml, set env vars locally, and run uvicorn pointing at feishu_toolkit.main — avoid opaque install scripts. - If the publisher can provide an official homepage or signed release (or if the install script is hosted on a well-known, verifiable domain such as a GitHub release), that would reduce supply-chain concern; ask the publisher for those artifacts. If you cannot verify the install sources, treat this skill as higher risk.

Type: OpenClaw Skill Name: official-feishu-toolkit Version: 1.0.0 The skill's core functionality and runtime code appear benign, providing a comprehensive toolkit for Feishu API integration (calendar, messaging, approval, etc.). All external API calls are directed to the official Feishu domain. However, the installation instructions in `SKILL.md` and `README.md` recommend executing a remote script via `curl -sL "https://backend.clawd.org.cn/api/skills/official%2Ffeishu-toolkit/install.sh" | sh`. While `clawd.org.cn` is presumed to be the official OpenClaw backend, this `curl | sh` pattern represents a significant Remote Code Execution (RCE) vulnerability, as it executes arbitrary code downloaded from a remote server without prior inspection. This is a high-risk installation method, classifying the skill as suspicious due to this inherent vulnerability, even without evidence of malicious intent in the skill's own code or explicit prompt injection.