OpenStoryline Use
ReviewAudited by ClawScan on May 10, 2026.
Overview
The OpenStoryline workflow is mostly coherent, but the skill includes an under-disclosed Feishu helper that can read OpenClaw Feishu credentials and upload local files to a chat.
Review the Feishu file-sending script before installing or using this skill. The core OpenStoryline commands appear purpose-aligned, but only provide API keys you trust the local project to use, keep services on 127.0.0.1, stop them when done, and do not allow any Feishu upload unless you explicitly approve the exact file and recipient.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If this helper is run, the agent could use stored Feishu app credentials to act through that Feishu integration.
The helper reads the user's OpenClaw configuration and extracts Feishu app credentials, even though the skill metadata declares no primary credential and the visible purpose is OpenStoryline editing.
OPENCLAW_CONFIG = Path.home() / ".openclaw" / "openclaw.json" ... app_secret = feishu_config.get("appSecret")Only allow this script if Feishu sending is explicitly needed; otherwise remove it or require clear user approval and declare the Feishu credential requirement.
A local file selected by the agent could be shared externally through Feishu if the helper is invoked.
The helper can upload a local file to Feishu and send it to a chat/user, with no artifact-level restriction to OpenStoryline output files or explicit disclosure in the visible workflow.
parser.add_argument("--file", required=True, help="Local file path") ... file_key = upload_file(token, file_path, args.file_type) ... send_file_message(token, receive_id, receive_id_type, file_key)Require explicit user confirmation of the exact file and recipient before any Feishu upload, and scope the helper to generated output files only.
Model provider keys may be stored in the OpenStoryline configuration and could appear in shell history or local files.
The skill asks for LLM/VLM API keys and writes them into config.toml; this is expected for OpenStoryline model use but is still sensitive credential handling.
你必须先向用户询问这些字段的具体值 ... `[llm].api_key` ... `[vlm].api_key` ... `python scripts/update_config.py --config ./config.toml --set llm.api_key=sk-REPLACE_WITH_REAL_KEY`
Use least-privilege provider keys, avoid pasting real secrets into shared logs, and review config.toml permissions.
OpenStoryline services may keep running locally after the editing task unless the user stops them.
The skill intentionally keeps local MCP/Web services running. This is disclosed and useful for editing sessions, but it creates lingering local processes.
长驻服务（MCP / Web）必须按“长驻进程”方式启动 ... 不要在任务执行中途主动终止 MCP / Web 服务，除非用户明确要求停止
Keep services bound to 127.0.0.1 as instructed and stop them when the editing session is complete.