Sync a local `wechat-report` result into Feishu Bitable after the user has reviewed the report and confirmed the sync.

This skill appears to legitimately sync local wechat-report data to Feishu Bitable, but beware: (1) the package metadata wrongly omits required environment variables — you must set FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_BITABLE_APP_TOKEN, and FEISHU_BITABLE_TABLE_ID before running; (2) the skill will follow a 'Raw JSON：<path>' line in the input markdown and may read that absolute path from disk — only run it on trusted input in an isolated workspace; (3) it uses and caches user/tenant tokens locally (protect those files); and (4) if you need higher assurance, review the feishu_auth helper module (not included here) and inspect runtime.py end-to-end. If any of these are unacceptable, do not install or run the skill until the metadata and documentation are corrected and you’ve audited token handling.

Type: OpenClaw Skill Name: content-system-feishu-bitable-sync Version: 1.0.0 The skill is designed to sync WeChat reports to Feishu Bitable as described. However, it contains a path traversal vulnerability in `runtime.py` within the `resolve_raw_payload_path` function, which extracts a file path from the input Markdown content using a regex and uses it (even if absolute) without validation. This could allow an attacker to trigger arbitrary file reads or overwrites if they can control the content of the input report. While the logic appears aligned with its stated purpose and lacks clear malicious intent, the lack of path sanitization is a significant security flaw.