PaperDaily

• Analyzed: May 11, 2026, 5:47 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3af481a6c69866f6ec56fbccac01c082c7c50eade1dd710697eb6d5fa4d56cc5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill delegates all core logic to an external dependency (openclaw-paperdaily) and requires sensitive Feishu API credentials (FEISHU_APP_SECRET). Most notably, SKILL.md instructs users to store these credentials in a .env file located inside the node_modules directory, which is highly irregular and could be used to obscure sensitive data from standard project audits. The lack of transparency in the external package combined with unusual secret management practices poses a significant risk.