OpenClaw Feishu Message

Send Feishu/Lark direct messages and work follow-ups from OpenClaw. Use when the user wants to search for a person in Feishu/Lark, resolve a user, create a 1...

This plugin appears to do what it says (look up Feishu contacts and send bot messages), but review these items before installing: - Inspect data/contact-cache.json: it contains many email addresses and phone numbers bundled with the plugin. Remove or sanitize this file if it contains PII you don't want included. - Confirm where Feishu credentials will come from: the plugin reads your OpenClaw config (~/.openclaw/openclaw.json) or the file pointed to by OPENCLAW_CONFIG_PATH to find appId/appSecret. If you don't want the plugin to read that file, do not install or set a safe OPENCLAW_CONFIG_PATH. - The cache path is hardcoded to /root/.openclaw/workspace/..., which may be inappropriate for your environment. If you run as a non-root user or in a constrained environment, ask the plugin author to make the data directory configurable or to use a runtime-provided workspace path. - Verify the Feishu appId/appSecret and tenant scopes before granting them (employee lookup, chat creation, and bot-send scopes are needed). Consider creating a limited-scope bot account for this plugin. If these concerns are acceptable or addressed (configuration of cache path, removal of bundled PII, and clear credential management), the plugin's behavior is consistent with its stated purpose. Otherwise treat it as potentially risky and request changes from the publisher.

Type: OpenClaw Skill Name: openclaw-feishu-message Version: 0.1.0 The skill bundle provides legitimate integration with Feishu/Lark for contact lookup and messaging. It demonstrates good security practices by implementing a secret redaction utility in `src/errors.js` to prevent credential leakage in logs and uses Zod for strict input validation in `src/tool-feishu-message.js`. While the bundle includes a pre-populated cache file (`data/contact-cache.json`) containing PII such as names and emails, this appears to be residual test data or stateful configuration rather than an intentional attempt at data exfiltration or malice.