Scan Report
0 /100
feishu-mention
Feishu @Mention Resolver — auto-converts @name mentions to <at> XML tags using OpenClaw config and Feishu API
A legitimate Feishu mention resolver that reads OpenClaw config, caches to a scoped directory, and calls official Feishu APIs. No hidden functionality, credential exfiltration, or suspicious behavior detected.
Safe to install
No action needed. The skill is safe to use.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | READ | READ | ✓ Aligned | index.js:51 — reads ~/.openclaw/openclaw.json |
| Filesystem | WRITE | WRITE | ✓ Aligned | index.js:34-36 — writes to ~/.openclaw/workspace/cache/feishu_mentions/ |
| Network | READ | READ | ✓ Aligned | index.js:95,138,165 — HTTPS calls only to open.feishu.cn official APIs |
3 findings
Medium External URL 外部 URL
https://open.feishu.cn/open-apis/bot/v3/info index.js:95 Medium External URL 外部 URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal index.js:138 Medium External URL 外部 URL
https://open.feishu.cn/open-apis/im/v1/chats/$ index.js:165 File Tree
13 files · 43.9 KB · 1416 lines Markdown 7f · 637L
JavaScript 4f · 495L
Python 1f · 254L
JSON 1f · 30L
├─
▾
assets
│ ├─
debug_guide.md
Markdown
│ ├─
example_usage.js
JavaScript
│ └─
send_message_example.js
JavaScript
├─
▾
scripts
│ └─
mention_resolver.py
Python
├─
AGENTS.md
Markdown
├─
FEISHU_MESSAGE_FORMAT.md
Markdown
├─
index.js
JavaScript
├─
integration.md
Markdown
├─
package.json
JSON
├─
QUICKSTART.md
Markdown
├─
README.md
Markdown
├─
SKILL.md
Markdown
└─
test.js
JavaScript
Security Positives
✓ No credential exfiltration: appSecret is used server-side to obtain tokens, never exposed
✓ Scoped filesystem access: only reads ~/.openclaw/ and writes to a dedicated cache subdirectory
✓ Network calls restricted to official Feishu API endpoints (open.feishu.cn)
✓ No base64, eval, or obfuscation patterns found
✓ No access to sensitive paths like ~/.ssh, ~/.aws, or .env
✓ Python script (scripts/mention_resolver.py) is a feature-equivalent port with no extra functionality
✓ SKILL.md accurately describes all capabilities and API interactions
✓ No subprocess, shell execution, or remote script download patterns
✓ Caching is transparent and scoped to the declared directory