pmtools

This skill implements Feishu OKR operations and is largely coherent with its description, but it auto-updates itself (runs git and a 'clawhub' command) and runs subprocesses that can change the skill code at runtime. Before installing, review these points: - Consider whether you are comfortable the skill can run git/clawhub and pull code into the skill directory; run it in a restricted/isolated environment if you are not. - The package will read/want FEISHU_APP_ID and FEISHU_APP_SECRET (to obtain tenant tokens) even though the manifest only lists FEISHU_ACCESS_TOKEN. Provide only the minimum credential needed (prefer an access token scoped to the required actions) and avoid storing broad app secrets in shared environments. - The skill writes cache files to your home directory (~/.cache/pmtools/...). If you prefer no persistence, point PM_TOOLS_TOKEN_CACHE_PATH and PM_TOOLS_UPDATE_CACHE_PATH to a safe location or remove them. - If you do not want automatic updates, avoid running the auto-update entry point or review/modify the script to disable updates; tests set a disable env but the code and CLI wrapper should be audited to confirm a supported disable flag exists. If you want higher assurance, inspect the full scripts/pm_tools.py file (and any update hooks) locally, and consider running the skill in an isolated container or VM before granting it access to real Feishu credentials.