Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Knowledge Organizer
v0.1.2Use when importing articles, organizing notes, or syncing a knowledge base across Obsidian, Feishu, and Tencent IMA with OpenClaw or Codex.
⭐ 1· 150·0 current·0 all-time
by@cjke84
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code and SKILL.md implement Obsidian writes, Feishu payload construction, duplicate detection, related-note suggestions, image handling, and a Tencent IMA OpenAPI transport — all consistent with the description. However, OPENCLAW_KB_ROOT is declared as the primary credential even though it is a filesystem path (not a secret), which is an odd but explainable choice for a vault-root-first skill.
Instruction Scope
Runtime instructions are scoped to the stated tasks: fetch/normalize → duplicate-check → render → write/sync. The SKILL.md explicitly warns that the bare python CLI is only for validation/dry-run and that real Feishu imports need an openclaw-lark transport. Scripts operate on local vault paths and build payloads for Feishu/IMA — they do not attempt to read unrelated system secrets or hidden endpoints in the provided content.
Install Mechanism
There is no network-based install spec (no downloads or archive extraction). The repository includes Python scripts and tests; the INSTALL.md recommends using openclaw skills install or bundling. This lowers install-time risk. The skill is folder-based and relies on existing python3/openclaw binaries rather than fetching arbitrary code at installation.
Credentials
The manifest/metadata mark IMA_OPENAPI_CLIENTID and IMA_OPENAPI_APIKEY as required environment variables. That is appropriate for IMA syncing, but it forces you to provide IMA credentials even if you only intend to use the Obsidian-only workflow. Additionally, feishu-related credentials used by the code (e.g., FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_ACCESS_TOKEN) are accessed by scripts but are not listed in the manifest's optionalEnv list — a mismatch. In short: required/optional env declarations are inconsistent with the code and may demand more secrets than strictly necessary in some deployment scenarios.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence or modify other skills. It does perform local file writes (Obsidian vault) and may call external APIs when configured, which is expected for its purpose. Autonomous invocation is allowed (default) but not combined with other red flags here.
What to consider before installing
This skill appears to do what it claims: it will read and write files in an Obsidian vault (OPENCLAW_KB_ROOT), run duplicate-detection and rendering scripts locally, and can sync to Feishu (via an OpenClaw plugin transport) or to Tencent IMA (via direct OpenAPI calls). Before installing:
- If you only want Obsidian/local usage, note the manifest marks IMA_OPENAPI_CLIENTID/IMA_OPENAPI_APIKEY as required; you should verify whether the runtime on your agent enforces those env vars or if you can run locally without setting them. Asking the publisher to make IMA creds optional would be cleaner.
- The feishu adapter reads FEISHU_APP_ID/FEISHU_APP_SECRET/FEISHU_ACCESS_TOKEN but those are not listed in the manifest optionalEnv — be cautious about providing Feishu secrets and confirm which variables the host will actually request. Prefer using an OpenClaw host that exposes the openclaw-lark transport instead of embedding credentials in the skill.
- Review and run scripts/check_runtime.py and run tests (pytest -q) in a sandboxed environment to confirm behavior before giving any API keys. Keep backups of your vault and run dry-run (--dry-run) for Feishu imports.
- Do not set FEISHU_IMPORT_ENDPOINT unless you intentionally want a custom transport override (SKILL.md warns about this).
Given the manifest/code mismatches around environment variables and the fact IMA creds are listed as required even for non-IMA use-cases, treat this skill with caution and verify environment requirements with the maintainer if you will supply API keys.Like a lobster shell, security has layers — review code before you run it.
latestvk9756czbhy8m835ngsja5ngvs983gkb1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
Any binopenclaw
EnvOPENCLAW_KB_ROOT, IMA_OPENAPI_CLIENTID, IMA_OPENAPI_APIKEY
Primary envOPENCLAW_KB_ROOT
