Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Wcs Helper Feishu Skill
v1.0.1Configure OpenClaw Feishu plugin without editing config files. Send simple commands via Feishu private chat to toggle streaming, set group reply behavior, ru...
⭐ 0· 84·0 current·0 all-time
by无上宗师@guanqi0914
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill declares no required binaries or environment variables, but the code invokes the 'openclaw' CLI, 'pgrep', and expects a Python3 runtime. It also reads ~/.openclaw/openclaw.json to obtain Feishu appId/appSecret. Declaring 'none' for required binaries/envs is inaccurate and misleading.
Instruction Scope
SKILL.md describes reading and modifying OpenClaw channel config and running diagnostics — the implementation does that by calling 'openclaw config get/set', 'openclaw status', and 'openclaw gateway restart'. The handler reads the local OpenClaw config for Feishu credentials and posts to the Feishu API. Instructions are generally within scope, but some SKILL.md features (e.g., 'apply automatic fixes' like fixing memory bloat or zombie autossh) are broader than what the code actually implements (the code performs status checks and issues restart/config set commands).
Install Mechanism
There is no remote install script or arbitrary download in the package; this is an instruction/code-only skill with Python files bundled. No high-risk URL downloads or archive extraction were found.
Credentials
The skill does not require declared env vars but reads ~/.openclaw/openclaw.json to extract Feishu appId/appSecret and caches tenant token to /tmp/feishu_card_token.json. Access to the OpenClaw config file is necessary for operation, but that file may contain other sensitive values; the metadata should have noted this dependency. The skill also runs local commands which require appropriate OS permissions.
Persistence & Privilege
always:false and normal autonomous invocation are used. The skill issues restart and config-set commands for OpenClaw (expected for this purpose) but does not attempt to change other skills or system-wide agent settings.
What to consider before installing
This skill appears to implement the advertised Feishu/OpenClaw configuration helpers, but its manifest understates what it needs. Before installing: 1) Inspect ~/.openclaw/openclaw.json — it will be read to obtain Feishu appId/appSecret; ensure you trust the source and that the file contains only expected credentials. 2) Be aware the skill will call the local 'openclaw' CLI and 'pgrep' and may restart the OpenClaw gateway; ensure the runtime user has permission for these operations. 3) The package caches a Feishu tenant token in /tmp/feishu_card_token.json. 4) If you require stronger assurance, run the skill in a test environment first or review/modify the code to limit which commands are executed (e.g., remove or gate restart/autofix actions). The issues are likely sloppy metadata rather than malicious behavior, but verify the OpenClaw config contents and the author's trustworthiness before granting it access to a production instance.Like a lobster shell, security has layers — review code before you run it.
latestvk971jpfppfzxj1v9ejd16t6cth83kzb7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.