Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
work-review-timemachine for feishu
v1.0.0Summarize a user's recent Feishu work into a concise weekly review or "time machine" recap by reading Feishu docs, meeting notes, and related materials, then...
⭐ 0· 160·0 current·0 all-time
byWangLei@nihiue
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose is to read a user's Feishu docs/meeting notes and create/update Feishu docs. Yet the package declares no credentials, no config paths, and no required binaries. Reading and writing a user's Feishu workspace normally requires an API token/connector or explicit auth flow, so the declared requirements do not match the functionality described.
Instruction Scope
SKILL.md instructs the agent to search the user's recent docs/wiki nodes, prioritize docs owned by the user, read transcripts, and create/update Feishu docs. Those runtime actions imply access to user data and writable workspace privileges. There is no explicit limit on which docs to read beyond heuristics, and no explicit mention of where collected data may be sent (it implies internal Feishu operations). The instructions also reference handling permission cards — which suggests an interactive OAuth/consent flow not documented in the skill manifest.
Install Mechanism
This is instruction-only with no install spec or downloadable code, so nothing new is written to disk. That lowers installation risk. There are no suspicious install URLs or packages.
Credentials
No environment variables, credential fields, or config paths are declared, yet the skill requires reading and writing Feishu workspace content. Either the skill expects the platform to supply Feishu connector credentials (not documented), or required credentials were omitted. Absence of declared secrets for a capability that needs them is disproportionate and should be clarified.
Persistence & Privilege
The skill does not request always:true, does not install binaries, and does not claim persistent agent-level modifications. Autonomous invocation is allowed (platform default) but not combined with other elevated privileges in the manifest.
What to consider before installing
This skill's instructions require reading and creating Feishu documents, which normally needs explicit authorization (API token or platform connector). Before installing, ask the publisher or platform: (1) how will the agent obtain Feishu access — is there a built-in Feishu connector or must you supply credentials/consent? (2) what exact OAuth scopes or API tokens will be used (read-only vs. write), and can you limit them? (3) where does any gathered data go — is it stored externally or only used in-session? If the platform provides a managed Feishu integration, verify its scope and consent flow; if not, treat the lack of declared credentials as a red flag and avoid granting broad workspace access until you confirm the auth mechanism and minimum required scopes. Consider testing with an account that has limited permissions or with non-sensitive docs first.Like a lobster shell, security has layers — review code before you run it.
latestvk974d4kp9dqaydnkhs1s9z6hc583779a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.