qqbot

Summary of what to check before installing: - Treat the example credential as suspicious. config.example.json contains an AppID and a clientSecret-like string. Do NOT assume this is a safe placeholder — verify it is not a real/active secret. If you ever ran this code with that secret, rotate the secret in your QQ developer console immediately. - The skill does not declare required credentials in metadata. You will need to provide APP_ID and APP_SECRET yourself (either by editing qq_official_bot.py or openclaw.json). Prefer storing secrets in a secure config or environment variables rather than committing them to code. - The install.sh will pip-install dependencies into your user environment and copy scripts into ~/.openclaw/workspace. Review install.sh before running; consider running in an isolated environment (container or VM) if you are unsure. - The repo includes multiple publishing automation scripts (playwright/agent-browser). These scripts interact with your browser and ~/Desktop files (e.g., they try to upload ~/Desktop/qqbot-v1.0.0.zip). Do not run them unless you intend to perform publishing and you understand they will access your filesystem and potentially drive a browser. - Runtime behavior: the bot writes/reads files in ~/.openclaw/workspace/qq_queue to exchange messages with a local AI handler and runs as a background process if you start the daemon. That is expected, but be aware of persistent background processes and local files containing messages. - If you want to proceed: remove any embedded secrets from the repo, replace them with clear placeholders, set your own APP_ID/APP_SECRET, inspect and (if needed) simplify or remove the publishing scripts, and run install/start steps in an isolated environment until you're confident. If you want, I can point out the exact lines/files where the example secret appears and suggest a minimal checklist of commands to safely inspect or run this skill.