ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      bryan-chx

      Safety Report

      Feishu Api Cache Fix

      @bryan-chx

      Reduces Feishu API calls from every minute to once every 2 hours by caching bot status, saving 99% of API quota usage.

      378Downloads
      0Installs
      0Stars
      2Versions
      API Integration12,700

      Security Analysis

      medium confidence
      Suspicious0.08 risk

      The skill's change (adding a 2-hour in-memory cache) matches its stated purpose, but it overwrites another extension's file under /usr/local without declaring that requirement or explaining the risk — running the provided sudo script from an unknown source is potentially dangerous.

      Feb 15, 20262 files5 concerns
      Purpose & Capabilitynote

      The name/description (reduce Feishu API calls by caching probe results) align with the included script, which replaces probe.ts with a caching implementation. However, the skill does not declare that it will write to OpenClaw's installation path (/usr/local/lib/node_modules/openclaw/extensions/feishu/src/probe.ts) or that it requires elevated privileges to do so. That mismatch between claimed 'no requirements' and the script's filesystem modification is noteworthy.

      Instruction Scopeconcern

      SKILL.md tells the user to run sudo bash fix_feishu_cache.sh. The script makes an unconditional backup and then overwrites the feishu probe.ts file at a hardcoded global node_modules path. It does not validate the existing file's contents, confirm compatibility, or limit changes to a local/test environment. While the change is narrowly scoped (no network/exfiltration), overwriting another extension's source file is broad in impact and could break or subvert the Feishu integration.

      Install Mechanismnote

      This is an instruction-only skill with no install spec (low install-surface). However, the included shell script writes to a system-installed node_modules path and requires sudo, so although there is no packaged installer, the script will persist changes on disk — treat as higher-risk than a purely read-only instruction.

      Credentialsconcern

      The skill declares no required environment variables or credentials, which fits the simple caching change. But it implicitly requires filesystem write access to OpenClaw's installation and root privileges (the SKILL.md calls sudo). The absence of any declared config paths or privilege requirement is an omission that reduces transparency.

      Persistence & Privilegeconcern

      The script modifies another extension's source file in the global node_modules tree — this is persistent and changes behavior of the Feishu integration beyond the skill's own files. The skill does not request 'always: true', but its disk modification of other component code is a privilege/impact that should be highlighted and approved explicitly by the operator.

      Guidance

      Do not run sudo scripts from an unknown source without review. This skill overwrites /usr/local/lib/node_modules/openclaw/extensions/feishu/src/probe.ts (it makes a .bak copy first) and requires root to do so. If you want this change: 1) Inspect fix_feishu_cache.sh line-by-line and confirm the target path matches your installation location; 2) Check the created backup (probe.ts.bak) before proceeding; 3) Prefer testing in a non-production environment or applying the change manually via a code review/patch so you can merge safely; 4) Consider modifying the extension in a package-managed way (fork or patch) rather than overwriting global node_modules; 5) Only proceed if you trust the author/source — the script could introduce breaking behavior even if it contains no network calls.

      Latest Release

      v1.0.1

      - Updated documentation in SKILL.md for clarity and brevity. - Simplified instructions and usage steps. - English translation of SKILL.md content; removed Chinese descriptions. - No changes to core functionality.

      Popular Skills

      CoinMarketCap Market Overview APIs

      @bryan-cmc · 2 stars

      CoinMarketCap MCP

      @bryan-cmc · 1 stars

      CoinMarketCap Crypto APIs

      @bryan-cmc · 1 stars

      Crypto Research using CoinMarketCap MCP

      @bryan-cmc · 0 stars

      CoinMarketCap x402 APIs

      @bryan-cmc · 0 stars

      CoinMarketCap Onchain Data APIs

      @bryan-cmc · 0 stars

      Published by @bryan-chx on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]