feishu-push — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited feishu-push (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
通过飞书开放平台 API 向指定飞书用户推送消息。
im:message(或 im:message:send_as_bot)权限FEISHU_APP_ID: 飞书应用 App ID (如 cli_a94a1d897cb85cbb)FEISHU_APP_SECRET: 飞书应用 App SecretPOST https://open.feishu.cn/open-apis/im/v1/messages# 获取 tenant_access_token
TOKEN=$(curl -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
-H "Content-Type: application/json; charset=utf-8" \
-d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" | \
node -e "let s=''; process.stdin.on('data', c => s += c); process.stdin.on('end', () => console.log(JSON.parse(s).tenant_access_token));")
# 发送文本消息
curl --request POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=user_id" \
--header "Authorization: Bearer $TOKEN" \
--header "Content-Type: application/json; charset=utf-8" \
--data-raw '{
"receive_id": "<USER_ID>",
"msg_type": "text",
"content": "{\"text\":\"你的消息内容\"}"
}'当前技能只接收飞书租户内用户 ID,即 receive_id_type=user_id。调用时传入的第一个参数必须是 user_id。
| msg_type | 说明 |
|---|---|
text | 文本消息 |
post | 富文本消息 |
image | 图片消息(需要先上传图片获取 key) |
file | 文件消息(需要先上传文件获取 key) |
audio | 音频消息 |
media | 视频消息 |
sticker | 表情 |
interactive | 互动卡片 |
share_chat | 分享群名片 |
share_user | 分享个人名片 |
system | 系统消息(仅单会话有效) |
# 用法: feishu-push text <user_id> "你的消息内容"推荐在环境中配置应用凭证:
export FEISHU_APP_ID="cli_a94a1d897cb85cbb"
export FEISHU_APP_SECRET="your_app_secret_here"常见错误码及处理:
230013: Bot 对该用户无可用权限 → 将用户添加到应用可用范围230006: 未启用机器人能力 → 在飞书开发者后台启用 bot 能力230029: 用户已离职 → 无法发送给已离职用户230053: 用户停止接收机器人消息 → 用户需要取消拉黑const tokenUrl = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal";
const messageUrl = "https://open.feishu.cn/open-apis/im/v1/messages";
async function postJson(url, payload, headers = {}) {
const response = await fetch(url, {
method: "POST",
headers: {
"Content-Type": "application/json; charset=utf-8",
...headers,
},
body: JSON.stringify(payload),
});
return response.json();
}
async function getTenantAccessToken() {
const data = await postJson(tokenUrl, {
app_id: process.env.FEISHU_APP_ID,
app_secret: process.env.FEISHU_APP_SECRET,
});
if (data.code !== 0) {
throw new Error(`Failed to get token: ${data.msg}`);
}
return data.tenant_access_token;
}
async function sendTextMessage(userId, content) {
const token = await getTenantAccessToken();
return postJson(
`${messageUrl}?receive_id_type=user_id`,
{
receive_id: userId,
msg_type: "text",
content: JSON.stringify({ text: content }),
},
{
Authorization: `Bearer ${token}`,
},
);
}
const [, , userId, message] = process.argv;
if (userId && message) {
const result = await sendTextMessage(userId, message);
console.log(JSON.stringify(result, null, 2));
}/feishu-push 给用户 7g9f6e2d 发送文本消息 "Hello from OpenClaw!"
/feishu-push send user_id 7g9f6e2d "这是一条测试推送消息"~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.