Security audit
Security checks across malware telemetry and agentic risk
This archiver mostly does what it says, but it automatically sends shared content to fixed Feishu resources while bundling sensitive credentials and unsafe shell-based helpers.
Review before installing. Replace and rotate all bundled Feishu and Twitter/X credentials, confirm the Feishu destination and notification recipient, require explicit confirmation before archiving shared links, and fix shell-command construction before using this on untrusted URLs or article content.
-d '{{"obj_type":"docx","parent_node_token":"{parent_token}","node_type":"origin","title":"{title}"}}'
'''
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if result.returncode != 0:
raise Exception(f"Failed to create node: {result.stderr}")def run_cmd(cmd):
"""执行命令并返回输出"""
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
return result.returncode, result.stdout, result.stderr
def get_access_token():-d '{"app_id":"cli_a90ecd03bc399bcb","app_secret":"gdEsio0WzDtHEhHFeLS55wBseDpExVtg"}' | jq -r '.tenant_access_token'
'''
result = subprocess.run(token_cmd, shell=True, capture_output=True, text=True)
if result.returncode != 0:
raise Exception(f"Failed to get token: {result.stderr}")-d '{{"obj_type":"docx","parent_node_token":"{parent_token}","node_type":"origin","title":"{title_escaped}"}}'
'''
result = subprocess.run(create_cmd, shell=True, capture_output=True, text=True)
if result.returncode != 0:
raise Exception(f"Failed to create node: {result.stderr}")# 调用 CLI
cmd = f'openclaw feishu-doc upload-image --doc-token "{doc_token}" --file-path "{image_path}"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
sys.exit(result.returncode)# 调用 CLI
cmd = f'openclaw feishu-doc {action} --doc-token "{doc_token}" --content "{content_escaped}"'
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
sys.exit(result.returncode)63/63 vendors flagged this skill as clean.