Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Feishu Screenshot
v1.0.0截取屏幕并发送到飞书。当用户说"截屏发给飞书"、"截图"、"屏幕截图"时使用这个技能。
⭐ 0· 326·8 current·8 all-time
by@tootw
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (capture screen and send to Feishu) match the actual instructions: a PowerShell full-screen capture, copying the image into the agent workspace, and a send action to the 'feishu' channel. However, the instructions hard-code user-specific paths (C:\Users\edy and /home/edy/.openclaw/workspace) and assume WSL-style paths (/mnt/c/...). Those assumptions are not justified in the metadata (no declared OS restriction or required binaries) and make the skill non-portable and potentially incorrect for other users.
Instruction Scope
The SKILL.md tells the agent to execute a PowerShell command that captures the entire primary screen and writes a PNG into the user's Pictures folder, then copies it into the agent workspace and triggers a send action. Capturing the full screen can expose sensitive data; the instructions run arbitrary shell commands and access absolute user paths. The instructions also do not include user consent or an explicit prompt before capturing, nor do they parameterize username/paths or handle non-Windows environments.
Install Mechanism
There is no install spec or code to write to disk; this is instruction-only. That minimizes supply-chain risk because nothing is downloaded or installed by the skill itself.
Credentials
The skill declares no required environment variables or credentials, but it issues a 'send' action to a 'feishu' channel (which implies the platform/agent must have Feishu credentials configured). The absence of any declared credential requirement is not necessarily wrong if Feishu access is provided by the platform, but it is not documented here. The skill also requires filesystem access to the user's Pictures folder and the agent workspace (hard-coded paths).
Persistence & Privilege
The skill does not request always: true, no installs, and does not attempt to modify other skills or system-wide configuration. It only instructs the agent to run commands at runtime.
What to consider before installing
This skill will execute a PowerShell command to capture your entire primary screen, save the image in C:\Users\edy\Pictures\screenshot.png, copy it into /home/edy/.openclaw/workspace, and then send it via the 'feishu' channel. Before installing or using it, consider the following:
- Privacy: Full-screen screenshots may capture passwords, private messages, or other sensitive data. Only allow this if you trust the agent and the destination (Feishu).
- Environment assumptions: The SKILL.md hard-codes a Windows username and uses /mnt/c/… and /home/… paths (WSL). If you are not running Windows with WSL or your username is not 'edy', the commands will fail or may target the wrong files. Ask the author to parameterize paths or confirm compatibility with your OS.
- Credentials: The skill does not declare Feishu credentials; verify how your platform provides Feishu access and whether the skill will use the correct account. If you do not want it to send automatically, require an explicit user confirmation step.
- Safety improvements: Prefer a version that (a) uses placeholders or variables for usernames and workspace paths, (b) prompts the user for confirmation before capturing/sending, (c) deletes temporary files after sending, and (d) documents required platform permissions (ability to run PowerShell and access the workspace).
If you cannot verify or modify the SKILL.md, run it only in a controlled environment (test account or VM) and inspect the commands the agent will execute. If you are uncomfortable with the hard-coded paths or automatic sending, do not install or invoke this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk9750mhm870weatfakfvb2z6q182z4a0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
