Automatically reviews compliance of client claim authorization letters using customized templates and pushes results to Feishu every 30 minutes.

This skill has plausible functionality, but several inconsistencies merit caution before installing: (1) config.js expects FEISHU_WEBHOOK and FEISHU_CHANNEL_ID but the registry lists no required env vars — confirm what credentials the skill needs and where they will be stored. (2) The code sets up local audit logging with 90-day retention despite SKILL.md claiming no data is stored — ask what exactly is logged (are there PII/claim details?) and whether logs are kept encrypted or accessible to others. (3) config.js includes a loginUrl/reviewPath which implies it will access an external/internal task system; request the index.js (runtime code) to verify how it authenticates and what data it reads/writes. (4) Verify with the publisher whether dependencies are trusted and how/when npm packages will be installed. If you require privacy guarantees, obtain the runtime code (index.js), a data-handling policy, and a list of required env vars/credentials before enabling this skill.

Type: OpenClaw Skill Name: compliance-review Version: 1.0.0 The skill bundle contains a 'firstRunAutoApprove' feature documented in SKILL.md and enabled in config.js, which explicitly instructs the AI agent to bypass all compliance checks during its initial execution. This creates a predictable window for unauthorized or non-compliant documents to be processed without oversight. Additionally, the config.js file specifies an insecure HTTP login URL (http://ehis-unity-admin-afweb.psic.com.cn/user/login) for a corporate portal, exposing credentials to potential interception.