Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (广告创意需求管理) match the code and README: create/review/breakdown/track demands. No unrelated binaries, env vars, or external packages are requested. References to integrations (feishu, ai-generation, workflow-orchestrator) are plausible collaboration points for a demand-management skill.
Instruction Scope
SKILL.md shows api.executeAction calls and event names consistent with a skill API, and the index.ts registers commands and emits/listens to events. However there are small naming mismatches: SKILL.md uses action/event names like 'demand-management.create' and 'demand-management.created', while index.ts registers a 'demand' command and emits 'demand.approved' / listens to 'demand.created'. This is likely a documentation mismatch but could cause runtime wiring issues on some platforms.
Install Mechanism
No install spec or external downloads; package.json lists only devDependencies. Nothing is written to disk by an installer step, lowering installation risk.
Credentials
The skill declares no required environment variables or credentials. Comments mention external services (Feishu) but the code only logs and emits events rather than directly calling external APIs, so no missing/overbroad credential requests were detected.
Persistence & Privilege
Skill is not configured with always:true and does not attempt to modify other skills or system-wide settings. It stores data in an in-memory Map (no persistent storage intended), so it has low privilege and limited persistence.
Assessment
This skill appears to be what it claims: a demand-management helper that runs inside the OpenClaw skill runtime and does not request secrets or run external installs. Before enabling it, consider: 1) The SKILL.md and index.ts use slightly different action/event names—verify the platform's event/action naming so commands and cross-skill events will actually connect. 2) Generated documents and notifications are only logged/emitted; connecting to Feishu or other services will require appropriate platform connectors/credentials—ensure those integrations are configured separately and intentionally. 3) The skill stores demands in memory (Map), so state will not survive restarts; if you need persistent storage, check whether the platform provides one or update the skill. If those points are acceptable, there are no obvious security red flags in the provided files.Like a lobster shell, security has layers — review code before you run it.
latestvk978skgrxp5xk0gr5hvt0rxbas836vy1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis