
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@max1874/feishu
Advanced tools
Feishu/Lark (飞书) channel plugin for OpenClaw.
openclaw plugins install @m1heng-clawd/feishu
Or install via npm:
npm install @m1heng-clawd/feishu
| Permission | Scope | Description |
|---|---|---|
contact:user.base:readonly | User info | Get basic user info (required to resolve sender display names for speaker attribution) |
im:message | Messaging | Send and receive messages |
im:message.p2p_msg:readonly | DM | Read direct messages to bot |
im:message.group_at_msg:readonly | Group | Receive @mention messages in groups |
im:message:send_as_bot | Send | Send messages as the bot |
im:resource | Media | Upload and download images/files |
| Permission | Scope | Description |
|---|---|---|
im:message.group_msg | Group | Read all group messages (sensitive) |
im:message:readonly | Read | Get message history |
im:message:update | Edit | Update/edit sent messages |
im:message:recall | Recall | Recall sent messages |
im:message.reactions:read | Reactions | View message reactions |
Required if using Feishu document tools (feishu_doc_*):
| Permission | Description |
|---|---|
docx:document | Create/edit documents |
docx:document:readonly | Read documents |
docx:document.block:convert | Markdown to blocks conversion (required for write/append) |
drive:drive | Upload images to documents |
drive:drive:readonly | List folders |
This is the most commonly missed configuration! If the bot can send messages but cannot receive them, check this section.
In the Feishu Open Platform console, go to Events & Callbacks:
| Event | Description |
|---|---|
im.message.receive_v1 | Receive messages (required) |
im.message.message_read_v1 | Message read receipts |
im.chat.member.bot.added_v1 | Bot added to group |
im.chat.member.bot.deleted_v1 | Bot removed from group |
openclaw config set channels.feishu.appId "cli_xxxxx"
openclaw config set channels.feishu.appSecret "your_app_secret"
openclaw config set channels.feishu.enabled true
channels:
feishu:
enabled: true
appId: "cli_xxxxx"
appSecret: "secret"
# Domain: "feishu" (China) or "lark" (International)
domain: "feishu"
# Connection mode: "websocket" (recommended) or "webhook"
connectionMode: "websocket"
# DM policy: "pairing" | "open" | "allowlist"
dmPolicy: "pairing"
# Group policy: "open" | "allowlist" | "disabled"
groupPolicy: "allowlist"
# Require @mention in groups
requireMention: true
# Max media size in MB (default: 30)
mediaMaxMb: 30
# Render mode for bot replies: "auto" | "raw" | "card"
renderMode: "auto"
| Mode | Description |
|---|---|
auto | (Default) Automatically detect: use card for messages with code blocks or tables, plain text otherwise. |
raw | Always send replies as plain text. Markdown tables are converted to ASCII. |
card | Always send replies as interactive cards with full markdown rendering (syntax highlighting, tables, clickable links). |
When you want the bot to @mention someone in its reply, simply @mention them in your message:
@张三 say hello → Bot replies with @张三 Hello!@bot @张三 say hello → Bot replies with @张三 Hello!The bot automatically detects @mentions in your message and includes them in its reply. No extra permissions required beyond the standard messaging permissions.
Check the following:
im.message.receive_v1 event?Ensure im:message:send_as_bot permission is approved.
Send /new command in the chat.
Feishu API has rate limits. Streaming updates can easily trigger throttling. We use complete-then-send approach for stability.
spawn npm ENOENTIf openclaw plugins install fails, install manually:
# 1. Download the package
curl -O https://registry.npmjs.org/@m1heng-clawd/feishu/-/feishu-0.1.3.tgz
# 2. Install from local file
openclaw plugins install ./feishu-0.1.3.tgz
openclaw plugins install @m1heng-clawd/feishu
或通过 npm 安装:
npm install @m1heng-clawd/feishu
| 权限 | 范围 | 说明 |
|---|---|---|
contact:user.base:readonly | 用户信息 | 获取用户基本信息(用于解析发送者姓名,避免群聊/私聊把不同人当成同一说话者) |
im:message | 消息 | 发送和接收消息 |
im:message.p2p_msg:readonly | 私聊 | 读取发给机器人的私聊消息 |
im:message.group_at_msg:readonly | 群聊 | 接收群内 @机器人 的消息 |
im:message:send_as_bot | 发送 | 以机器人身份发送消息 |
im:resource | 媒体 | 上传和下载图片/文件 |
| 权限 | 范围 | 说明 |
|---|---|---|
im:message.group_msg | 群聊 | 读取所有群消息(敏感) |
im:message:readonly | 读取 | 获取历史消息 |
im:message:update | 编辑 | 更新/编辑已发送消息 |
im:message:recall | 撤回 | 撤回已发送消息 |
im:message.reactions:read | 表情 | 查看消息表情回复 |
使用飞书文档工具(feishu_doc_*)需要以下权限:
| 权限 | 说明 |
|---|---|
docx:document | 创建/编辑文档 |
docx:document:readonly | 读取文档 |
docx:document.block:convert | Markdown 转 blocks(write/append 必需) |
drive:drive | 上传图片到文档 |
drive:drive:readonly | 列出文件夹 |
这是最容易遗漏的配置! 如果机器人能发消息但收不到消息,请检查此项。
在飞书开放平台的应用后台,进入 事件与回调 页面:
| 事件 | 说明 |
|---|---|
im.message.receive_v1 | 接收消息(必需) |
im.message.message_read_v1 | 消息已读回执 |
im.chat.member.bot.added_v1 | 机器人进群 |
im.chat.member.bot.deleted_v1 | 机器人被移出群 |
openclaw config set channels.feishu.appId "cli_xxxxx"
openclaw config set channels.feishu.appSecret "your_app_secret"
openclaw config set channels.feishu.enabled true
channels:
feishu:
enabled: true
appId: "cli_xxxxx"
appSecret: "secret"
# 域名: "feishu" (国内) 或 "lark" (国际)
domain: "feishu"
# 连接模式: "websocket" (推荐) 或 "webhook"
connectionMode: "websocket"
# 私聊策略: "pairing" | "open" | "allowlist"
dmPolicy: "pairing"
# 群聊策略: "open" | "allowlist" | "disabled"
groupPolicy: "allowlist"
# 群聊是否需要 @机器人
requireMention: true
# 媒体文件最大大小 (MB, 默认 30)
mediaMaxMb: 30
# 回复渲染模式: "auto" | "raw" | "card"
renderMode: "auto"
| 模式 | 说明 |
|---|---|
auto | (默认)自动检测:有代码块或表格时用卡片,否则纯文本 |
raw | 始终纯文本,表格转为 ASCII |
card | 始终使用卡片,支持语法高亮、表格、链接等 |
如果你希望机器人的回复中 @ 某人,只需在你的消息中 @ 他们:
@张三 跟他问好 → 机器人回复 @张三 你好!@机器人 @张三 跟他问好 → 机器人回复 @张三 你好!机器人会自动检测消息中的 @ 并在回复时带上。无需额外权限。
检查以下配置:
im.message.receive_v1 事件?确保已申请 im:message:send_as_bot 权限,并且权限已审核通过。
在聊天中发送 /new 命令即可开启新对话。
飞书 API 有请求频率限制,流式更新消息很容易触发限流。当前采用完整回复后一次性发送的方式,以保证稳定性。
spawn npm ENOENT如果 openclaw plugins install 失败,可以手动安装:
# 1. 下载插件包
curl -O https://registry.npmjs.org/@m1heng-clawd/feishu/-/feishu-0.1.3.tgz
# 2. 从本地安装
openclaw plugins install ./feishu-0.1.3.tgz
MIT
FAQs
OpenClaw Feishu/Lark channel plugin
We found that @max1874/feishu demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.