feishu-calendar
Security checks across malware telemetry and agentic risk
Overview
The code largely implements a Feishu/Lark calendar manager (matching the description), but there are several coherence issues (undeclared required credentials, missing helper files, and scripts that delete/create events and modify local files) that warrant caution before installing or running.
Before installing or running: - Do not run these scripts in a production account or with credentials from an important/organizational Feishu app until you review them. The code can create, modify, and delete calendar events and ACLs. - Verify and provide only the minimal app credentials (FEISHU_APP_ID and FEISHU_APP_SECRET) and restrict the app's permissions if possible. - Confirm whether OPENCLAW_MASTER_ID is required; SKILL.md does not document it but search_cal.js references it. - Inspect setup_routine.js and cleanup.js: they delete events and create recurring 'maintenance' events (these do not execute system restarts but create calendar entries that mention restarts). If you don't want auto-creation/deletion, remove or modify those scripts. - Note the scripts write to repository files (HEARTBEAT.md and memory/calendar_events.json). Back up these files before running and run first in an isolated workspace. - The code references ../common/time-helper.js which is missing; expect runtime errors until that dependency is provided or references removed. - Run npm install only in a trusted environment and review the package.json/lockfile; dependencies appear standard. - If you are unsure, test using a dedicated Feishu test account/app with limited scope and observe behavior before granting any broader access.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings