Feishu Power Skill

What to check before installing: - Credentials: This skill needs FEISHU_APP_ID and FEISHU_APP_SECRET (feishu_api.py). The registry metadata does not declare those—do not assume none are needed. Create a Feishu app with the minimal permissions required and use those credentials, not high-privilege tenant keys if avoidable. Rotate the credentials after testing. - Review schedule.yaml: The scheduler can execute arbitrary local scripts (custom jobs) and will run enabled jobs automatically when you run report_generator.py. If you enable scheduled jobs, verify each job's params (script path, publish flag, folder_token, app tokens) so it cannot run unexpected commands or publish sensitive data. - Isolation: Run first in an isolated environment (non-production account or VM/container) and inspect outputs. The installer links into ~/.openclaw/skills and report_generator creates .report_state.json and may write reports to disk—ensure those file locations are acceptable. - Code audit: Because the repository contains all code, scan for any hidden endpoints or hardcoded secrets (none were found in this package), and confirm that publishing actions (docx create/write) target the intended Feishu tenant/folders. - If you don't need scheduling or custom-script features, avoid enabling them (set jobs disabled) to reduce blast radius. Given the coherent functionality but metadata omission and scheduler/script execution capability, treat this as potentially useful but verify credentials, permissions, and scheduled jobs before use.