← Back to Skills Marketplace
magicaldd

Feishu Reaction

by magicaldd · GitHub ↗ · v1.1.0
cross-platform ⚠ suspicious
422
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install feishu-reaction
Description
Add or remove emoji reactions on Feishu (Lark) messages, and respond to user reactions. Use when the user asks to react to a message, add an emoji/expression...
README (SKILL.md)

Feishu Reaction

Add/remove emoji reactions on Feishu messages via API. Enables richer, more playful interactions beyond text.

Usage

# Add reaction
bash scripts/feishu-reaction.sh \x3Cmessage_id> \x3Cemoji_type>

# Remove reaction
bash scripts/feishu-reaction.sh \x3Cmessage_id> \x3Cemoji_type> remove

Resolve scripts/feishu-reaction.sh relative to this skill's directory.

Getting message_id

The message_id comes from inbound message metadata (e.g., om_x100b554e82c620a4c...). Use the current message's message_id from conversation context.

Behavior Guide

Proactive reactions to user messages

React to user messages naturally, like a human would:

  • User says something nice → HEART, THUMBSUP, or YEAH
  • User shares good news → PARTY, FIREWORKS, or CLAP
  • User asks for help → OK (then reply with text)
  • User sends something funny → SMILE or WITTY

Don't overdo it — not every message needs a reaction. Use when it adds warmth without cluttering.

Responding to user reactions

When a user reacts to your message with an emoji, respond appropriately:

Positive/neutral reactions (HEART, THUMBSUP, YEAH, GoGoGo, FISTBUMP, PARTY, CLAP, SMILE, WOW, SaluteFace, WINK, GLANCE, etc.): → React back with a complementary emoji. No text reply needed.

Negative/questioning reactions (ANGRY, SPEECHLESS, FACEPALM, CRY, TERROR, SWEAT, WHAT, etc.): → React back with a caring emoji (HUG, HEART) AND follow up with a text message asking what's wrong.

Choosing reaction emojis

Pick reactions that feel natural and varied — don't always use the same one. Match the energy:

  • They send ❤️ → reply with 🤗 or ❤️
  • They send 💪 → reply with 🔥 or 💪
  • They send 👀 → reply with 😉

Available Emoji Types

Common: THUMBSUP, SMILE, OK, HEART, LOVE, THANKS, YEAH, AWESOME, PARTY, CLAP, APPLAUSE

Emotions: CRY, ANGRY, SHY, BLUSH, SPEECHLESS, TERROR, WOW, FACEPALM, SWEAT, PROUD, OBSESSED

Actions: WAVE, HUG, KISS, WINK, TONGUE, MUSCLE, SALUTE

Objects: FIRE, BEER, CAKE, GIFT, ROSE, FIREWORKS

Other: WITTY, JIAYI

Prerequisites

  • Feishu channel configured in OpenClaw (openclaw.json has channels.feishu.appId and appSecret)
  • App has im:message:reaction permission (飞书开放平台 → 应用权限 → 消息与群组 → 表情回复)

Examples

React with thumbs up to acknowledge a message:

bash scripts/feishu-reaction.sh "om_xxx" "THUMBSUP"

React with heart to show appreciation:

bash scripts/feishu-reaction.sh "om_xxx" "HEART"

Remove a reaction:

bash scripts/feishu-reaction.sh "om_xxx" "THUMBSUP" remove
Usage Guidance
This skill's functionality is coherent, but it quietly reads your OpenClaw config file to get the Feishu appId/appSecret even though the registry metadata didn't declare that requirement. Before installing: (1) verify you want this skill to access $HOME/.openclaw/openclaw.json (or set OPENCLAW_CONFIG to a safe location); (2) inspect openclaw.json to ensure it does not expose unrelated secrets; (3) confirm the Feishu app has only the minimum permissions (im:message:reaction) and that you trust the app credentials will be used only to call open.feishu.cn; (4) if you need stronger guarantees, request the skill owner to declare the required config path/credentials in the metadata and to prefer explicit env vars rather than reading broad config files; and (5) consider running the skill in a restricted/sandboxed environment or review network traffic to confirm no unexpected endpoints are contacted.
Capability Analysis
Type: OpenClaw Skill Name: feishu-reaction Version: 1.1.0 The skill is classified as suspicious due to significant input sanitization vulnerabilities in `scripts/feishu-reaction.sh`. The script directly interpolates `$MSG_ID` and `$EMOJI_TYPE` into `curl` commands without proper escaping or validation. This creates potential JSON injection vulnerabilities (via `emoji_type` in the POST body) and URL injection vulnerabilities (via `message_id` in the URL path and `emoji_type` in URL query parameters). While the `SKILL.md` instructions guide the agent to use predefined emoji types, the script itself does not enforce this, making it vulnerable if the agent is prompted to pass arbitrary user-controlled input. There is no evidence of intentional malicious behavior like data exfiltration or unauthorized remote control, but these vulnerabilities could be exploited to achieve such outcomes.
Capability Assessment
✓ Purpose & Capability
Name/description, SKILL.md, and the included script all align: the skill adds/removes reactions via Feishu APIs using an app's credentials. No unrelated services or binaries are requested.
✓ Instruction Scope
Runtime instructions and the script only perform operations needed to add/remove reactions (read openclaw.json, get tenant token, call Feishu reaction endpoints). They do not call other external endpoints or read unrelated system paths.
✓ Install Mechanism
No install spec (instruction-only with an included shell script). Nothing is downloaded or written by an installer — risk from install mechanism is low.
⚠ Credentials
The script reads openclaw.json (APP_ID and APP_SECRET) from $OPENCLAW_CONFIG or $HOME/.openclaw/openclaw.json, but the registry metadata declared no required config paths or primary credential. That mismatch (missing declaration of required config/credentials) is disproportionate and should be fixed or justified. Also note openclaw.json may contain other sensitive values; the script reads the file directly.
✓ Persistence & Privilege
Skill is not always-on, does not request persistent system modifications, and does not modify other skills' configs. It runs on demand via the script.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install feishu-reaction
  3. After installation, invoke the skill by name or use /feishu-reaction
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
v1.1.0: Added behavior guide for proactive reactions and responding to user reactions. Positive reactions get emoji reply, negative/questioning reactions trigger follow-up. Makes Feishu interactions more playful and natural.
v1.0.0
Initial release: add/remove emoji reactions on Feishu messages via API
Metadata
Slug feishu-reaction
Version 1.1.0
License —
All-time Installs 0
Active Installs 0
Total Versions 2
Frequently Asked Questions

What is Feishu Reaction?

Add or remove emoji reactions on Feishu (Lark) messages, and respond to user reactions. Use when the user asks to react to a message, add an emoji/expression... It is an AI Agent Skill for Claude Code / OpenClaw, with 422 downloads so far.

How do I install Feishu Reaction?

Run "/install feishu-reaction" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Feishu Reaction free?

Yes, Feishu Reaction is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Feishu Reaction support?

Feishu Reaction is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Feishu Reaction?

It is built and maintained by magicaldd (@magicaldd); the current version is v1.1.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463556 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259610 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200551 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191226 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190235 · by oswalpalash

💬 Comments