feishu-chat-extractor

Pass

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/monitor_wulao.py uses subprocess.run to orchestrate the execution of extract_chat.py and analyze_content.py. The command arguments are constructed using hardcoded paths and programmatic timestamps, minimizing the risk of arbitrary command injection.
  • [CREDENTIALS_UNSAFE]: The extraction logic includes routines to read API tokens and configuration from local files such as ~/.openclaw/agents/main/agent/feishu-app-token.txt and .env. This is standard practice for managing credentials in automation scripts and follows established secret management patterns.
  • [DATA_EXPOSURE]: As its primary function, the skill accesses and retrieves group chat messages from the Feishu API. The processed data is stored locally in JSON and Markdown formats for reporting and analysis by the user.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the official Feishu API endpoint (open.feishu.cn) to fetch message data. This is a well-known service required for the skill's documented functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 18, 2026, 01:11 AM
Security Audit — agent-trust-hub — feishu-chat-extractor