Cwork Skill Update

This skill largely does what it claims (wrappers around CWork APIs) but has two important red flags you should address before installing: 1) Missing declared credentials: the package metadata says no env vars are required, yet the scripts expect CWORK_APP_KEY (and optionally CWORK_BASE_URL) to call the CWork API. Confirm how authentication will be provided and ensure you do not run the scripts without appropriate, least-privilege credentials. 2) Hard-coded GitHub token: scripts/cwork-report-issue.py contains a baked-in _BUILTIN_TOKEN and documentation telling users that a shared token is embedded. That token will be used to create GitHub Issues and could receive whatever error or diagnostic text the scripts send — potentially leaking sensitive details to that GitHub repository. Prefer disabling automatic issue submission, remove the built-in token, or replace it with your own GITHUB_TOKEN provided via environment variable. Audit the issue-body construction to ensure no sensitive data (like full API payloads, tokens, or attachments) will be posted. Actionable steps before use: - Inspect cwork_client.py to confirm how it reads CWork credentials and what network endpoints it contacts. - Remove or rotate any embedded tokens (do not use the built-in token). Require GITHUB_TOKEN be set in your environment if you want issue reporting, and consider disabling auto-reporting entirely. - If you will permit autonomous agent invocation, restrict the agent’s permission to call this skill until you’ve validated its behavior and confirmed it will not exfiltrate sensitive content. - If you cannot audit or remove the embedded token, do not install or run this skill in sensitive environments.