Latest release: v2026.9.2Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
The plugin requires Feishu app credentials, optional webhook secrets, network access to Feishu/Lark or a user-configured HTTPS domain, and can upload selected local or remote media; these are proportionate to the integration but should be scoped carefully.
Install Mechanism
The package has no install scripts; metadata points to an npm install of @openclaw/feishu with bundled runtime/setup entries and ordinary Feishu/Lark SDK dependencies.
Instruction Scope
The bundled skills are Feishu-specific and include safety guidance for exact IDs, destructive edits, and private uploads, but several activation descriptions use broad phrases that could trigger on generic cloud-doc, folder, or wiki requests.
Persistence & Privilege
The manifest does not start on startup by itself, but an enabled channel runs a long-lived gateway, keeps runtime identity/dedupe/session state, and can create per-user agents only when dynamicAgentCreation and configWrites are explicitly enabled.
Purpose & Capability
Capabilities match the stated Feishu/Lark channel and workplace-tool purpose: messaging, document/Drive/wiki/Bitable operations, comments, and optional permission management. Sensitive mutations are exposed as explicit tool actions, and the permission tool is disabled by default.
Scan Findings in Context
[SQP-1] unexpected: For feishu-drive, the broad activation wording is artifact-supported, but it is downgraded because the skill body and tool actions are Feishu Drive-specific and include target-resolution and private-data handling guidance.
[SQP-1] unexpected: For feishu-doc, the broad activation wording is artifact-supported, but it is downgraded because the instructions and runtime actions are Feishu document-specific and include safeguards for block IDs, whole-document replacement, and uploads.
[SQP-1] unexpected: For feishu-wiki, the broad activation wording is artifact-supported, but it is downgraded because the workflow is limited to Feishu wiki spaces/tokens and does not direct generic wiki access.
Assessment
Install this only if you intend to connect a Feishu/Lark app to OpenClaw. Use least-privilege Feishu app scopes, keep DM and group allowlists tight, disable unused tool families such as doc, drive, wiki, bitable, scopes, or perm, and leave vcAutoJoin and dynamicAgentCreation off unless you specifically need them. Confirm destructive edits, deletes, permission changes, and any local-file or remote-URL uploads before allowing an agent to act.dist/client-DMbIL3UH.js:19
Environment variable access combined with network send.
Confirmed safe by external scanners
Static analysis detected API credential-access patterns, but both VirusTotal and OpenClaw confirmed this skill is safe. These patterns are common in legitimate API integration skills.Verification
Tags
OpenClaw Feishu/Lark
Official OpenClaw channel plugin for Feishu and Lark workplace chats. Community maintained by @m1heng.
Install from OpenClaw:
openclaw plugins install @openclaw/feishu
Configure the Feishu/Lark app credentials in OpenClaw, then connect the plugin to the chats where agents should receive and send messages.