Feishu Connect

This skill appears to do what it says (initiate Feishu OAuth and produce a clickable verification link), but there are a few things to consider before installing or using it: - Runtime dependency: The instructions use curl but the manifest does not declare curl as required. Ensure your agent runtime has curl available. - Secret handling: The OAuth poll returns client_id and client_secret. The skill gives no guidance to avoid printing or storing these secrets; they may appear in chat logs or saved cookie files. If you install, confirm how secrets are handled and consider running the skill in a restricted environment. - Cookie file: The skill writes /tmp/feishu_cookies.txt. That file may be accessible to other local users/processes. If this is a concern, modify the workflow to use a secure temporary path. - The forced '&from=maxclaw' parameter and the prohibition on reading docs/channels/feishu.md are unusual. Ask the author why that parameter is required and why the skill explicitly forbids reading local documentation—this could be legitimate (tracking/integration requirement) but should be explained. - If you need stronger assurance, request the skill source or run the process in a sandboxed agent environment. If you cannot verify secret handling and origin of the skill, treat it cautiously and avoid using it with high-privilege accounts.