feishui-file-sender — 飞书文件发送器
v1.0.0通过...发送文件 Feishu channel 使用消息工具 with 文件路径参数.
0· 547·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill does what it claims (package and send files to a Feishu chat) but its runtime instructions explicitly read and zip files from the agent workspace and then send them to an external chat — which makes it easy to exfiltrate sensitive data and is not constrained or justified by the metadata.
评估建议
This skill will let the agent package files from the agent workspace and send them to a Feishu chat using the platform's messaging capability. That is coherent with its description, but it is also a straightforward channel for data exfiltration if misused. Before installing or enabling it: (1) Confirm the Feishu channel and destination chat ID are trusted and under your control; (2) Avoid allowing the agent to zip or send directories that may contain secrets (API keys, private keys, credentials,...详细分析 ▾
ℹ 用途与能力
Name/description (send files to Feishu) align with the instructions: the SKILL.md shows how to package a skill folder and call message(..., channel='feishu', filePath=...). However the instructions specifically target /root/.openclaw/workspace/skills (agent internal workspace), which expands the capability beyond a generic 'send a chosen file' scenario and is worth calling out.
⚠ 指令范围
The SKILL.md tells the agent to run shell commands that read and zip files from the agent's workspace (/root/.openclaw/workspace/skills) and then to call message(...) with an absolute filePath. This explicitly instructs reading local agent files and transmitting them to an external Feishu target. There are no constraints, confirmation steps, or sanitization rules — the agent could be directed to package and send any files inside the workspace (which may include secrets). That broad I/O and transmission behavior is the main risk.
✓ 安装机制
Instruction-only skill with no install spec and no code files — nothing written to disk by an installer. This minimizes installation risk.
ℹ 凭证需求
The skill declares no required environment variables or credentials, which is expected because it relies on the OpenClaw 'message' tool and the platform's configured Feishu channel. However, that means the skill implicitly uses the agent's Feishu credentials to transmit files; the lack of any explicit credential declaration is not wrong but you should verify the channel configuration and who controls the destination chat ID.
✓ 持久化与权限
always:false and no install or code that modifies agent configuration are present. The skill does not request permanent presence or elevated privileges beyond invoking the message/send flow at runtime.
安装前注意事项
- Confirm the Feishu channel and destination chat ID are trusted and under your control; (
- Avoid allowing the agent to zip or send directories that may contain secrets (API keys, private keys, credentials, logs); (
- Require explicit, human-confirmed file paths and a checklist of what will be sent rather than allowing arbitrary paths; (
- Inspect or lock down the implementation of the message(...) tool to ensure it enforces sender policies/rate limits and logs actions; (
- Prefer running this skill in a restricted test environment first. If you cannot enforce those safeguards, do not enable this skill for autonomous use.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/25
feishu-file-sender 1.0.0 - Initial release. - Allows sending binary files via Feishu channel using the message tool with a filePath parameter. - Supports targeting both Feishu groups and users. - Includes usage instructions, parameter descriptions, and troubleshooting tips.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install feishui-file-sender
镜像加速npx clawhub@latest install feishui-file-sender --registry https://cn.clawhub-mirror.com
技能文档
Send binary files (ZIP, PDF, images, etc.) to Feishu groups or users.
Prerequisites
- OpenClaw configured 带有 Feishu channel
- Target chat ID (分组 或 用户)
Step 1: 包 Skill/File
cd /root/.openclaw/workspace/skills
zip -r /tmp/skill_name.zip skill_folder/
键: 使用 relative path inside zip, 不 absolute path.
Step 2: 发送 通过 Feishu
message(
action="send",
channel="feishu",
filePath="/tmp/skill_name.zip",
message="📦 Skill Name",
target="oc_xxxxxxxxxxxx" # chat ID
)
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| action | string | Yes | "send" |
| channel | string | Yes | "feishu" |
| filePath | string | Yes | Absolute path to file |
| message | string | Yes | Caption text |
| target | string | Yes | Chat ID (oc_xxx for groups, user ID for DM) |
Common Issues
- File too large: Feishu limits apply (~20MB 对于 最多)
- Wrong path: 使用 absolute path
/tmp/xxx.zip - Relative path 在...中 zip: 包 从 parent dir, e.g.,
zip -r /tmp/out.zip folder/
示例: 发送 Skill
# Package
cd /root/.openclaw/workspace/skills
zip -r /tmp/weather.zip weather/# Send
message(action="send", channel="feishu", filePath="/tmp/weather.zip", message="📦 weather skill", target="oc_group_id")
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制