Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Feishu Sync Obsidian Local

v1.2.1

将飞书 Wiki 文档同步到 Obsidian PARA 知识库。 触发:当用户说"同步飞书"或"同步文档"时使用。 遵循 Pipeline 模式,4 步顺序执行,带硬检查点。 必需文件:vault 根目录必须有 SYNC-RULES.md。

0· 108·1 current·1 all-time
bykai@ink-kai

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ink-kai/feishu-sync-obsidian-local.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Feishu Sync Obsidian Local" (ink-kai/feishu-sync-obsidian-local) from ClawHub.
Skill page: https://clawhub.ai/ink-kai/feishu-sync-obsidian-local
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install feishu-sync-obsidian-local

ClawHub CLI

Package manager switcher

npx clawhub@latest install feishu-sync-obsidian-local
Security Scan
Capability signals
Requires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the included code: scripts/sync.py performs path construction and file writing, while content fetch is delegated to agent tools (feishu_fetch_doc / feishu_wiki_space_node). No external credentials or binaries are declared — which is consistent with the design that the agent tool (not this skill) holds Feishu API access. However, some bundled reference files embed an app_token/table_id (see references/archive/para-mapping-legacy.md), which is unexpected for a local sync tool and not used by the script.
!
Instruction Scope
SKILL.md directs the agent to read vault/SYNC-RULES.md, call agent fetch tools, and then call sync.py --plan/--write. Those instructions stay within the stated sync scope. Concerns: (1) SKILL.md and assets claim the skill will append a section to vault/AGENTS.md and set up an automatic weekly systemd timer, but there is no install step or code that performs those actions — this is an inconsistency and could mislead users about automatic behavior; (2) the frontmatter unconditionally includes feishu_doc_token and feishu_node_token — storing these tokens in vault files may expose them if the vault is synced publicly or to third-party services.
Install Mechanism
No install spec (instruction-only) and the Python script is included in the bundle. No downloads or archive extraction are performed. This is low-risk from an installer perspective.
!
Credentials
The skill declares no required env vars or credentials and the script only optionally reads VAULT_DIR. That is coherent because content fetch is delegated to agent tools. Nevertheless, the package includes an apparent Feishu app_token and table_id inside references (not used by the script) — this is unexpected and may be sensitive. Also, persisting feishu_doc_token into frontmatter means Feishu tokens/IDs will be stored in the vault; if that vault is backed up or synced externally, tokens/identifiers may be exposed.
Persistence & Privilege
always is false and autonomous invocation is allowed (platform default). The skill will create files and directories inside the user's vault and uses /tmp for sync_state — expected for its purpose. The earlier claim about automatic weekly systemd timer is not implemented in provided code; if the agent or user config sets up scheduled runs, that increases how often tokens/data may be accessed, so confirm scheduling behavior before enabling automation.
What to consider before installing
What to check before installing: - Inspect the Feishu-fetching agent tool (feishu_fetch_doc / feishu_wiki_space_node) that this skill expects: confirm it uses least-privilege credentials and that tokens are stored/used safely. The sync script does not perform API calls itself. - Search the skill files for any hard-coded tokens/IDs (references/archive/para-mapping-legacy.md contains an app_token and table_id). Treat those as potentially sensitive; verify whether they are valid and rotate/revoke if they are real and you don't control them. - Consider the privacy of storing feishu_doc_token and feishu_node_token in Obsidian frontmatter: if your vault is synced to cloud services or shared, these identifiers/tokens could be exposed. If that is a concern, modify the frontmatter policy or strip tokens after de-duplication. - Note SKILL.md/assets claim automatic actions (appending to AGENTS.md, weekly systemd timer). The provided code does not implement automatic install or timers — do not assume auto-scheduling will be set up without an explicit install step you review. - Test in dry-run mode on a disposable vault (use --dry-run or a test VAULT_DIR) to confirm behavior and that file paths/duplicates are handled as expected. - Backup your vault before first run and review /tmp/feishu-sync-obsidian/sync_state.json for any retained state; clear sensitive state if needed. Given these inconsistencies and the presence of embedded tokens in reference files, proceed only after verifying the agent fetch tool and removing or verifying any hard-coded tokens.

Like a lobster shell, security has layers — review code before you run it.

latestvk974r1ycj36pkj14vt6qtrhdxh84ndpv
108downloads
0stars
4versions
Updated 2w ago
v1.2.1
MIT-0

Feishu → Obsidian PARA Sync

模式:Pipeline | 数据源和目标路径从 SYNC-RULES.md 读取


核心设计

内容获取由 Agent 的 feishu_fetch_doc 工具完成,Python 脚本只做路径构建和文件写入。 这样无需在脚本里管理 Access Token,也不需要在 clawhub 发布时携带敏感权限。


硬性规则

禁止跳过步骤。禁止在用户确认前进入下一步。


Step 1 — 前置检查 + 获取 Wiki 节点(并行遍历)

触发:用户要求同步飞书文档

1a. 前置检查

  1. 检查 vault 根目录是否存在 SYNC-RULES.md
    • 不存在 → 触发初始化流程
  2. 读取 SYNC-RULES.md 中的「数据源」表格

1b. 获取 Wiki 根节点

使用 feishu_wiki_space_node 工具获取每个 Wiki 的根节点。

1c. 并行遍历子节点

对于 has_child: true 的节点,并行获取子节点:

  • 每个 has_child 节点分配一个并行任务
  • 各分支同时请求,不等待串行
  • 递归直到所有分支都没有子节点
个人成长 (root)
├── 2026-03 (has_child) ──────┐
│   └── 7个子节点              │ 并行遍历
├── 软考笔记 (has_child) ──────┼
│   └── 4个课程文件夹          │ 并行遍历
├── Obsidian 整理报告
└── 辞职决策记录

openclaw知识库 (root)
├── 11个文档节点(部分有子节点)  并行遍历

1d. 生成同步计划

将完整节点列表传给 sync.py --plan,获取待写入文件清单:

echo '[节点JSON]' | python3 sync.py --stdin --plan

输出

  • need_fetch:需要 Agent fetch 内容的 docx 文档
  • no_fetch_needed:只写占位符的非 docx 类型

Gate:显示节点总数、来源 Wiki、待写入文件数,问用户确认是否继续。


Step 2 — 确认同步路径

触发:Step 1 确认后

执行sync.py --plan 已输出每个文件的 relative_pathfilename,显示路径映射表。

Gate:显示写入路径映射表,确认是否继续。


Step 3 — 获取文档内容并写入 Obsidian

触发:Step 2 确认后

3a. Agent fetch 内容

need_fetch 中的每个文档,调用 feishu_fetch_doc 获取正文。

3b. 批量写入

将「文档信息 + fetch 到的内容」传给 sync.py --write

echo '[{"title":"...","obj_token":"...","content":"...",...}]' \
  | python3 sync.py --stdin --write [--dry-run]

frontmatter 生成规则

  • 基础字段:datelastmoddraftcategoriestags
  • 飞书扩展字段:无条件追加feishu_doc_tokenfeishu_wikifeishu_node_token
  • feishu_doc_token 用于去重,已存在则跳过

目录自动创建

relative_path 目录不存在时,自动创建。

Gate:显示将写入的文件列表,确认后执行。


Step 4 — 质量检查

触发:Step 3 执行完成后

执行

  1. 加载 references/review-checklist.md
  2. 对照检查清单验证同步结果
  3. 报告检查结果

输出格式

【同步报告】
- 写入:X 个文档
- 跳过:X 个(已存在)
- 失败:X 个(错误信息)

初始化流程

触发:vault 缺少 SYNC-RULES.md

执行

  1. 向用户说明缺少文件
  2. 生成默认版本(SYNC-RULES.md 模板)
  3. 展示给用户确认
  4. 用户确认后写入 vault 根目录
  5. 继续 Step 1

模板文件assets/sync-rules-template.md


参考文件

文件作用
scripts/sync.py纯路径构建 + 写入工具,双模式(--plan / --write)
assets/sync-rules-template.mdSYNC-RULES.md 生成模板
assets/agents-template-additions.mdAGENTS.md 补充章节
references/review-checklist.md同步质量检查清单

已知限制

  • 电子表格(sheet)、多维表格(bitable)、思维导图(mindnote)只写链接占位符,不拉内容
  • 并行遍历依赖 subagent 能力,每个 has_child 分支可同时请求
  • Space ID 和目标路径从 SYNC-RULES.md 读取,修改配置后重新同步即可生效

Comments

Loading comments...