Lark Bot

飞书/Lark Bot 完整对接方案 - 所有敏感配置从环境变量读取，支持消息收发、知识库操作、Bitable 任务管理

This skill appears to do what it says (Feishu/Lark bot tools). Before installing/running: 1) ensure you set LARK_APP_SECRET (do NOT leave it empty), because the webhook server skips signature checks when the secret is unset; 2) avoid running these scripts where stdout logs are publicly accessible because example code prints access tokens; 3) restrict the webhook port behind a firewall or reverse proxy and validate the code if you plan to expose it publicly; 4) set only the minimal environment variables needed for the features you use (e.g., only set TABLE_ID/APP_TOKEN if you need Bitable). If you need higher assurance, have someone you trust audit the code for logging/exfiltration before deployment.

Type: OpenClaw Skill Name: xiaoman-lark-bot Version: 1.0.1 The skill bundle provides a legitimate integration for Lark/Feishu bots, covering message delivery, Bitable task management, and Wiki operations. The implementation uses standard Python libraries (urllib.request) to interact exclusively with official Lark API endpoints (open.larksuite.com) and follows security best practices by retrieving sensitive credentials from environment variables. No evidence of data exfiltration, malicious execution, or prompt injection was found across the scripts or documentation.