Feishu Bot Config Helper
v0.1.2辅助配置飞书机器人名称、应用凭证和大模型，自动匹配技能并生成本地及飞书文档。
0· 189·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code mostly matches its stated purpose (auto-configure Feishu bots) but the installation method (curl|bash from GitHub / re-cloning remote repo) and instructions that encourage pasting App Secret into chat and storing it in openclaw.json raise security/privacy concerns.
评估建议
This skill appears to perform the configuration tasks it claims, but proceed cautiously:
- Do NOT blindly run curl | bash from raw.githubusercontent.com. Inspect the install.sh contents on GitHub (or use the registry bundle) before executing.
- The install script clones the repository at install time; this may fetch code different from the bundle you reviewed. Prefer installing from the registry copy or reviewing the remote repo before running.
- The skill asks you to paste App ID and App Secret...详细分析 ▾
ℹ 用途与能力
The skill's files (auto-configure-bot.js, install.sh) implement the claimed functionality: parsing a text config, creating workspaces, updating ~/.openclaw/openclaw.json and restarting the Gateway. However the included install.sh and SKILL.md both instruct users to fetch/execute a remote install script (raw.githubusercontent.com), and install.sh itself performs a git clone from the same GitHub repo — unnecessary when code is already bundled in the registry and increases risk of pulling different code at install time.
⚠ 指令范围
The runtime instructions and script require the user to provide App ID and App Secret inside a plain text message (e.g., Feishu chat). The script then writes those credentials directly into openclaw.json under channels.feishu.accounts. Encouraging credentials to be sent in chat and persisted in a local JSON file (likely unencrypted) is a privacy/security risk outside the narrow task of config automation.
⚠ 安装机制
SKILL.md recommends running curl -fsSL https://raw.githubusercontent.com/... | bash and install.sh executes git clone and npm install. Download-and-execute from a raw GitHub URL and re-cloning a remote repository are higher-risk install patterns (remote code executed at install time). Although GitHub is a known host, this pattern allows the installer to run arbitrary, possibly updated remote code that may differ from the registry bundle.
ℹ 凭证需求
The skill requires no declared environment variables, which aligns with its purpose. However it asks users to supply App ID/App Secret in messages and stores them into openclaw.json — this is functionally necessary but disproportionate in privacy terms because secrets are handled via chat and persisted in plaintext config without explicit guidance on secure storage.
✓ 持久化与权限
The skill does not request always:true, does not modify other skills, and only updates the user's ~/.openclaw/openclaw.json and creates per-agent workspace directories. It also restarts the local 'openclaw gateway' process via exec, which is consistent with the stated purpose but is an operation with system impact that the user should expect.
⚠ scripts/auto-configure-bot.js:172
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.22026/3/17
- Major update restructures the skill with a streamlined codebase and configuration flow. - Added: `CHANGELOG.md`, `package.json`, and a new `scripts/auto-configure-bot.js` automation script. - Removed: Legacy scripts and redundant documentation files to simplify usage and maintenance. - Reworked: Updated `README.md` and `SKILL.md` to reflect new auto-configuration approach, supported Agents, and modern file organization. - Installation: Now supports one-command install for Mac/Linux and Windows. - Focus shifted to automated Feishu bot and Agent setup with openclaw.json integration and smarter matching.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install feishu-bot-config-helper
镜像加速npx clawhub@latest install feishu-bot-config-helper --registry https://cn.clawhub-mirror.com
技能文档
版本: v1.0.0 类型: 飞书机器人自动配置 难度: ⭐⭐⭐⭐
📋 技能概述
在飞书对话中直接配置新机器人，自动完成 Agent 创建、工作空间配置、Gateway 重启。
🎯 核心能力
- ✅ 飞书机器人自动配置
- ✅ 智能 Agent 匹配（7 种规则）
- ✅ 自动更新 openclaw.json
- ✅ 自动重启 Gateway
- ✅ 返回配置报告
🚀 安装方式
Mac / Linux
curl -fsSL https://raw.githubusercontent.com/jiebao360/feishu-bot-config-helper/main/install.sh | bash
Windows
curl -fsSL https://raw.githubusercontent.com/jiebao360/feishu-bot-config-helper/main/install.bat -o install.bat
.\install.bat
🎭 Agent 阵容
| Agent | 职责 | 默认模型 |
|---|---|---|
| 第二大脑笔记虾 | 知识管理 + 素材提供 | doubao-pro |
| 朋友圈创作虾 | 朋友圈文案创作 | doubao |
| 电商视频导演虾 | 电商视频脚本 | doubao-pro |
| 通用内容创作虾 | 通用内容创作 | doubao |
| 图片素材生成虾 | 图片搜索 + 生成 | doubao-pro |
| 电商 Seedance 导演虾 | Seedance 提示词 | doubao-pro |
| 工作助手 | 工作相关任务 | doubao |
⚙️ 配置规范
严格遵循官方模板：
- 每个飞书机器人对应一个独立 Agent
- 拥有独立的工作空间和记忆
- 在
agents.list中定义 Agent - 在
channels.feishu.accounts中配置机器人 - 在
bindings中添加路由绑定 - 使用
dmScope: "per-account-channel-peer" - 群组策略使用
groupPolicy: "open"
📁 文件清单
feishu-bot-config-helper/
├── scripts/
│ └── auto-configure-bot.js # 自动配置脚本
├── index.js # 主入口
├── install.sh # Mac/Linux 安装脚本
├── install.bat # Windows 安装脚本
├── package.json # 项目配置
├── SKILL.md # 技能文档
├── README.md # 使用说明
├── CHANGELOG.md # 更新日志
└── LICENSE # MIT 许可证
🔗 相关资源
- GitHub: https://github.com/jiebao360/feishu-bot-config-helper
- OpenClaw 文档: https://docs.openclaw.ai
- 飞书开放平台: https://open.feishu.cn/
🦞 让龙虾成为你的飞书机器人配置助手！
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制