Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feishu Plugin Conflict Fix
v1.0.0飞书插件工具冲突修复工具。解决 feishu_chat 命名冲突、TTS 语音配置、多 Bot 工具隔离等问题。 **当以下情况时使用此 Skill**： (1) feishu_chat 工具命名冲突 (2) 飞书发送信息附带 MP3 语音 (3) 需要多 Bot 工具隔离配置 (4) openclaw-lark...
⭐ 0· 84·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description and SKILL.md consistently target OpenClaw/Feishu plugin conflicts; the commands shown (openclaw config set, tools list, gateway restart, editing ~/.openclaw/openclaw.json) are coherent with that purpose. However, the skill metadata declares no required binaries or install steps even though the instructions assume the presence of the openclaw CLI, jq, cp/mv/rm, and npx. This mismatch is an implementation/documentation gap.
Instruction Scope
The runtime instructions perform sensitive local actions: backing up and overwriting ~/.openclaw/openclaw.json, deleting plugin directories (rm -rf ~/.openclaw/plugins/feishu*), enabling/disabling plugins, and restarting the OpenClaw gateway. Those actions are within the stated repair scope but are destructive and should be run only with explicit user consent and reliable backups. The instructions also call npx to install a package (executes code from the network).
Install Mechanism
There is no declared install spec, yet SKILL.md runs npx -y @larksuite/openclaw-lark install which downloads and executes code from npm at runtime. Using npx is a network operation with execution risk; it's a plausible step to reinstall an official plugin but the skill provides no provenance (no homepage/source) and didn't declare this requirement in metadata.
Credentials
The skill requests no environment variables or credentials and SKILL.md doesn't try to read unrelated secrets. Access is limited to local OpenClaw config files and plugin directories, which are proportionate to the stated purpose.
Persistence & Privilege
The skill does modify system-wide OpenClaw configuration files and restarts gateways/agents (impactful operations), but it does not request always: true or attempt to alter other skills' code. This level of privilege is expected for a tool that reconfigures OpenClaw, but it increases blast radius if executed unintentionally.
What to consider before installing
This skill appears to do what it says (fix Feishu/OpenClaw plugin conflicts) but take precautions before running its commands: 1) Verify you have the openclaw CLI and tools the guide uses (jq, npx) installed. 2) Manually inspect and back up ~/.openclaw/openclaw.json and any plugin directories before running scripts—the provided scripts delete and overwrite files. 3) Be cautious about the npx -y @larksuite/openclaw-lark install step: npx will fetch and execute code from npm; verify the package name and source (no homepage/source is provided here). 4) Prefer running the steps manually one-by-one in a test environment to confirm effects rather than executing the one-click scripts. 5) If you cannot verify the author or package provenance, avoid the network install step and reinstall plugins from a trusted source. Additional information that would raise confidence: an official homepage or repo for the skill/author, explicit declaration of required binaries, and confirmation that @larksuite/openclaw-lark is the intended official package.Like a lobster shell, security has layers — review code before you run it.
latestvk9761p835strdbbnx6yfa1y1th84gf8b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.