Principle: Ask for less, not more
When you integrate OpenClaw with Feishu, every permission you grant is a potential blast radius. The rule is simple: request only what you need, and review often.
Permission checklist
| Permission Scope | Typical Need | Recommendation |
|---|---|---|
im:message | Send/receive messages | Required for chat workflows |
im:message.group_at_msg | Read @mentions in groups | Use only if your bot must react to group @s |
contact:user.base:readonly | Read user profiles | Usually unnecessary for most bots |
contact:department.base:readonly | Read org structure | Only if your flow needs org context |
calendar:calendar:readonly | Read calendars | Only for calendar-aware flows |
drive:drive:readonly | Read docs | Only if your agent processes documents |
Dangerous permissions to avoid unless strictly required:
contact:user.base:readonly— Exposes user names, emails, phones. Most Feishu bots do not need this.- Any write scope beyond what your flow explicitly needs.
im:message:read_as_app— Read all messages in a group. Use only when you truly need it, and document why.
Periodic audit with deep mode
Run a full permission and behavior audit regularly:
openclaw security audit --deep
This checks:
- Granted scopes vs. actually used scopes
- Webhook configuration and endpoint exposure
- Sensitive data handling patterns in your skills and agents
Webhook security
- Use HTTPS only. Never expose webhooks over HTTP.
- Validate webhook signatures. Feishu signs payloads; verify them before processing.
- Prefer app-level webhooks over user-level when possible; limit token exposure.
Sensitive data handling
- Do not log message bodies or user IDs unless required for debugging, and then only in non-production.
- If a skill reads contacts or calendars, ensure it does not persist that data beyond the current request.
- Map out where PII flows: Feishu → OpenClaw → skills → external APIs. Each hop should be justified.
Summary
Keep Feishu + OpenClaw permissions tight: avoid contact:user.base:readonly and other broad scopes unless you have a clear use case. Run openclaw security audit --deep regularly, secure webhooks, and treat sensitive data with care.