Web To Feishu

将任意网页链接或本地文件一键转为结构化 Markdown，并保存到飞书云文档或腾讯 ima 笔记。 支持的信源：(1) X/Twitter 推文、长文 Article、Thread 线程；(2) 微信公众号文章； (3) YouTube 视频；(4) 任意 HTML 网页；(5) 本地文件：PDF、Word、PP...

Security Scan

The skill's code, declared env vars, and runtime instructions generally match its stated purpose (converting web/local content to Markdown and saving to Feishu/IMA), but there are several small inconsistencies and an external dependency you should vet before use.

Purpose & Capability

The skill claims to convert webpages/local files and save to Feishu or Tencent IMA; the packaged Python clients explicitly use FEISHU_APP_ID/FEISHU_APP_SECRET and IMA_CLIENT_ID/IMA_API_KEY and call the documented service endpoints—these credentials and network calls are appropriate for the stated feature. The code includes converters for tweets and a generic HTML/local-file flow, which matches the description.

Instruction Scope

Runtime instructions are focused on conversion and storage. The SKILL.md and scripts run converters and client code that read a provided URL/path and environment variables for target APIs. The skill invokes an external tweet fetcher (x-tweet-fetcher) by running its script via subprocess and writes a temporary JSON file during conversion—this is expected for Twitter support but means the fetcher's behavior affects security. The instructions require cloning external tooling into a user workspace; that expands the runtime surface beyond the packaged files.

Install Mechanism

There is no automatic install spec (instruction-only), which reduces installer risk. However, SKILL.md asks you to pip-install third-party packages (markitdown / markitdown-plus) and to clone x-tweet-fetcher into ~/.aily/workspace/skills. Pulling and running a third-party repository is a manual but real risk vector: you should verify the source and contents of x-tweet-fetcher and the markitdown package before installing. There is also a mild naming mismatch (SKILL.md mentions markitdown-plus while code imports markitdown).

Credentials

The only required secrets are FEISHU_APP_ID/FEISHU_APP_SECRET and IMA_CLIENT_ID/IMA_API_KEY, which are directly relevant to saving documents to those services. The clients read only those env vars (and optionally support .env via python-dotenv). No unrelated credentials or system tokens are requested.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide agent configuration. It expects a workspace path (~/.aily/workspace/skills) for an optional external dependency; it creates temporary files during conversion but does not persist credentials or change global settings.

Assessment

This skill appears to do what it says, but take these precautions before installing or using it: - Only set FEISHU_APP_ID/FEISHU_APP_SECRET and IMA_CLIENT_ID/IMA_API_KEY for accounts you control; treat these like passwords and rotate if exposed. - The Twitter path requires an external repository (x-tweet-fetcher). Manually review that repository (its origin, code, network calls) before cloning and running it—it will be executed via subprocess and has access to network and file I/O. - Verify the third‑party Python package names: the SKILL.md mentions markitdown-plus but code imports markitdown; confirm which package you need and audit it before pip install. - Run the clients in a sandbox or non-production account the first time to verify behavior and endpoints (Feishu and IMA endpoints are in the docs, but double-check URLs and returned responses). - Be cautious when converting local files containing sensitive data: the tool will read and send content to external services (Feishu/IMA) if you choose to save there. - If you need higher assurance, request the upstream repository/homepage for x-tweet-fetcher and markitdown, and ensure the skill's references match the actual packages and locations. If anything in the external fetcher or markitdown package looks suspicious, do not run it with your credentials.

网页内容转飞书/ima文档

将任意网页链接或本地文件一键转为结构化 Markdown，并保存到飞书云文档或腾讯 ima 笔记。

支持的信源

信源	URL 特征	抓取方式
X/Twitter	x.com / twitter.com	x-tweet-fetcher
微信公众号	mp.weixin.qq.com	markitdown-plus
YouTube	youtube.com / youtu.be	markitdown-plus
任意网页	其他 http(s):// 链接	markitdown-plus

本地文件支持

类型	扩展名
PDF	.pdf
Word	.docx / .doc
PowerPoint	.pptx / .ppt
Excel	.xlsx / .xls
图片	.png .jpg .jpeg .gif .webp
音频	.mp3 .wav .m4a .flac
数据	.csv .json .xml

输出目的地

目的地	环境变量	说明
Markdown 文件	无	默认选项，始终生成
飞书云文档	FEISHU_APP_ID + FEISHU_APP_SECRET	参考 references/feishu-setup.md
腾讯 ima	IMA_CLIENT_ID + IMA_API_KEY	云端 API，无需本地客户端，参考 references/ima-setup.md

安全配置

⚠️ 凭证必须通过环境变量配置，禁止硬编码：

飞书配置

# 设置环境变量
$env:FEISHU_APP_ID = "your_app_id"
$env:FEISHU_APP_SECRET = "your_app_secret"

参考 references/feishu-setup.md 获取凭证。

ima 配置

# 设置环境变量
$env:IMA_CLIENT_ID = "your_client_id"
$env:IMA_API_KEY = "your_api_key"

参考 references/ima-setup.md 获取凭证。

工作流

步骤 1：转换为 Markdown

python3 scripts/web_to_md.py --url "<url_or_path>" --output <output.md>

路由逻辑：

• X/Twitter → x-tweet-fetcher 抓取 JSON → tweet_to_md.py 结构化转换
• 其他所有 → markitdown-plus 直接转换

步骤 2：存入目的地

飞书云文档

from scripts.feishu_client import FeishuClient

client = FeishuClient()
result = client.create_document(title="文档标题", content_md=markdown_content)
print(f"文档 URL: {result['url']}")

腾讯 ima

from scripts.ima_client import IMAClient

client = IMAClient()
result = client.create_note(title="笔记标题", content=markdown_content)
print(f"笔记 URL: {result['url']}")

验证连接

# 验证飞书
python scripts/feishu_client.py --action test

# 验证 ima
python scripts/ima_client.py --action test

故障处理

问题	解决方案
x.com SSL 超时	x-tweet-fetcher 使用 FxTwitter API 中转
markitdown 模块丢失	pip install markitdown
微信反爬拦截	markitdown 自动用移动端 UA 重试
飞书凭证无效	检查 FEISHU_APP_ID 和 FEISHU_APP_SECRET
ima 凭证无效	检查 IMA_CLIENT_ID 和 IMA_API_KEY

依赖

依赖	安装
markitdown-plus	pip install markitdown
x-tweet-fetcher	克隆到 ~/.aily/workspace/skills/x-tweet-fetcher
requests	pip install requests
python-dotenv	pip install python-dotenv