Get笔记炼金术

PassAudited by VirusTotal on May 5, 2026.

Overview

Type: OpenClaw Skill Name: getnote-alchemy Version: 1.0.0 The 'GetNote Alchemy' skill is a productivity tool designed to process audio recordings from the GetNote App into structured knowledge bases like Feishu Bitable and IMA. It features a comprehensive privacy-filtering framework (defined in references/privacy-rules.md) that instructs the agent to automatically redact sensitive PII such as ID numbers, bank cards, and passwords before data is archived. The code and instructions are transparent, aligned with the stated purpose, and contain no evidence of malicious exfiltration, unauthorized execution, or harmful prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can access private Get笔记录音内容 and create or update 飞书 resources under the user’s connected account/workspace.

Why it was flagged

The skill needs Get笔记 credentials and delegated 飞书 access to pull private recording notes and write archive records. This is expected for the integration, but it is sensitive account authority.

Skill content
环境变量:GETNOTE_API_KEY、GETNOTE_CLIENT_ID ... 飞书的凭证由 OpenClaw 飞书通道统一管理
Recommendation

Use scoped/revocable API keys where available, store secrets only in the platform’s credential manager, and revoke access if you stop using the skill.

What this means

Private client, meeting, class, or business-recording information may become searchable and reusable across future tasks or shared workspaces.

Why it was flagged

The skill intentionally stores distilled recording content in persistent, searchable knowledge systems. That matches the purpose, but creates long-lived reusable context that may contain sensitive professional information if redaction is imperfect.

Skill content
多端沉淀:飞书多维表格(结构化检索)+ 可选IMA知识库 + 可选飞书知识库
Recommendation

Review 飞书/IMA sharing permissions, retention expectations, and redaction results before enabling optional knowledge-base or team-wiki sync.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If scheduled mode is enabled, new recordings may be processed and archived without the user initiating each individual run.

Why it was flagged

The skill documents a scheduled mode that automatically scans and processes new recordings. This is disclosed and purpose-aligned, but it is ongoing autonomous behavior.

Skill content
cron触发 → 扫描auto_scan_hours内新录音 → 自动处理
Recommendation

Enable cron/scheduled processing only if you want continuous automation; otherwise keep usage to explicit single-record or user-directed batch runs.

What this means

The skill can create tables and write records in 飞书, which may affect workspace organization and visibility.

Why it was flagged

The documentation directs the agent to create 飞书多维表格 apps and records. These are account/workspace mutations, but they are clearly tied to the skill’s archive purpose.

Skill content
feishu_bitable_create_app(name="Get笔记录音知识台账") ... feishu_bitable_create_record({ ... })
Recommendation

Confirm the target 飞书 workspace and sharing settings before first run, and periodically check that records are going to the intended table only.