feishu-bridge
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The bridge script accesses local configuration and secret files (
~/.clawdbot/secrets/feishu_app_secretand~/.clawdbot/clawdbot.json) to authenticate sessions with Feishu and the local agent gateway. The instructions explicitly guide users to set restricted file permissions (chmod 600) to protect these credentials. - [COMMAND_EXECUTION]: The
setup-service.mjsscript generates a macOS launchd plist file to provide persistent background execution for the bridge. This is a standard and documented procedure for ensuring the service remains active across system restarts. - [EXTERNAL_DOWNLOADS]: The skill utilizes the official Feishu Node.js SDK (
@larksuiteoapi/node-sdk) and the standardwslibrary. These are well-known, trusted dependencies required for the skill's primary functionality of establishing secure WebSocket connections.
Audit Metadata