Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Enterprise AI Assistant Bundle
v1.0.0One-stop enterprise AI assistant solution integrating Feishu and OpenClaw for quick deployment of smart customer service, group chat assistant, and workflow...
⭐ 0· 137·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description promise a Feishu + OpenClaw assistant and the code matches that purpose, but the skill metadata declares no required environment variables or primary credential while the code and README clearly require OpenClaw API key, Feishu App ID and App Secret. The metadata omission is incoherent and hides necessary privileges.
Instruction Scope
SKILL.md instructions are mostly in-scope (install deps, create Feishu app, run deploy script). However the runtime instructions rely on creating config.json that contains secrets and on implicit runtime behavior in deploy.py (auto pip installs). The bot code also contains a TODO for actually sending replies to Feishu — the current implementation will call OpenClaw and return replies but does not post them back, so the user must modify/complete behavior.
Install Mechanism
There is no formal install spec in the registry, but deploy.py will attempt to auto-install dependencies via os.system('pip install ...') at runtime. Auto-installing packages from PyPI at runtime increases risk (supply-chain / unexpected packages). This is moderate risk compared to a declared, reviewed install spec.
Credentials
The code expects OPENCLAW_API_KEY (env) and requires Feishu App ID/Secret passed to deploy.py, yet the registry lists no required env vars/credentials. deploy.py writes the Feishu app_secret into config.json in plaintext and writes a placeholder for the OpenClaw API key. Storing secrets on disk and failing to declare required credentials are disproportionate and concerning.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide settings, and only creates files under the current directory (config.json, skills/). No elevated persistence privileges are requested.
What to consider before installing
Before installing or running this skill: (1) Understand it requires Feishu App ID/Secret and an OPENCLAW_API_KEY even though the registry metadata doesn't list these — treat that as a red flag. (2) Review the included files yourself: deploy.py will auto-run pip installs if dependencies are missing and writes your app_secret into config.json in plaintext. Prefer setting OPENCLAW_API_KEY as an environment variable rather than embedding credentials in files. (3) Test in an isolated environment/container and do not use production credentials until you vet the OpenClaw and lark packages on PyPI (confirm the correct packages and versions). (4) Consider auditing the network endpoints (https://api.openclaw.ai/v1) and verifying the maintainer/contact info. (5) If you need this functionality but want lower risk: extract the minimal code you need, pin dependency versions, remove auto-install behavior, and avoid writing secrets to disk (or encrypt them / use a secrets manager).Like a lobster shell, security has layers — review code before you run it.
latestvk97b4xymzkaz81rw44sfmzns49833x0c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.