Resignation Check

对 Office 365 / Adobe 租户的用户做离职检查——通过飞书开放平台 API（app_id/app_secret）按邮箱核对通讯录，列出疑似离职账号并交互确认删除。USE WHEN 离职检查, 离职筛查, 清理离职, 离职账号, resignation check, 账户审计, 清户, 飞书核对,...

This skill plausibly does what it says, but treat it as high-risk until you audit the code and limit privileges: 1) Do NOT run against production credentials. Create a test tenant or read-only accounts first. 2) Manually review the GitHub repo (https://github.com/eggyrooch-blip/office365-tools) before cloning—inspect install scripts, requirements, and any subprocess or network calls. 3) Ensure least-privilege: avoid granting User.ReadWrite.All / LicenseAssignment.ReadWrite.All unless deletions are intentionally needed; prefer read-only scopes during initial runs. 4) Do not store high-value secrets in plaintext .env on shared machines; use a secrets vault when possible. 5) Validate FEISHU_APP_ID/SECRET and Adobe creds scope; confirm SMTP use is necessary. 6) Confirm and back up account lists and policies before performing deletions; prefer generating reports and manual approval workflows. 7) Fix the metadata mismatch: ask the publisher why registry metadata omits required env vars. If you cannot verify the repo and code, do not install or run this skill.

Type: OpenClaw Skill Name: resignation-check Version: 0.5.0 The skill automates user offboarding across Office 365, Adobe, and Feishu, requiring high-privilege administrative credentials (CLIENT_SECRET, FEISHU_APP_SECRET) and SMTP passwords. It is classified as suspicious because it mandates cloning and executing code from an external GitHub repository (eggyrooch-blip/office365-tools) and performs destructive account deletions. While the skill.md includes safety instructions like mandatory user confirmation (AskUserQuestion) and logic to avoid deleting system accounts, the reliance on external artifacts and the handling of multiple sensitive secrets represent a significant supply chain and security risk.