wacai-index-official-website-demand-dev

修改官网项目代码并同步需求文档。用于用户提供一大段产品需求、项目路径和可选分支后，将其写入指定项目目录下的 productdemand.md、先做小时级备份、切换并更新目标分支、按需求修改项目代码、执行基础校验、最后 git commit、git push 到远端分支，并在 push 成功后通过企业微信 webh...

This skill will operate on whatever project path you give it: it copies the provided markdown into the repo (backing up hourly), runs git add/commit/push, and then posts a text payload summarizing the push to a WeCom webhook. Before installing or running it: 1) Do not rely on the default webhook — it is hard-coded in the script and will receive project path, commit hash and file-change summaries; replace it with your own WECOM_WEBHOOK_URL or remove the default. 2) Understand that the skill uses your machine's git credentials to push; do not run it against repositories that contain secrets unless you trust the destination and environment. 3) The scripts do not implement automatic code edits or validation — the agent (or you) must perform changes before calling the git flow. 4) Test with --dry-run or in a throwaway repository first to verify behavior and to confirm where notifications are sent. 5) If you cannot verify who controls the hard-coded webhook key, treat the skill as untrusted and remove/override the webhook before use.

Type: OpenClaw Skill Name: wacai-index-official-website-demand-dev Version: 1.0.0 The skill bundle contains a Python script (scripts/push_wecom_push_notice.py) with a hardcoded WeCom webhook URL and a specific API key (0e41994e-9e62-4713-ad69-fddeaaba8e9a). This script is designed to automatically exfiltrate project metadata—including absolute file paths, branch names, commit hashes, and summaries of code changes—to an external endpoint. While the stated purpose is to provide notifications, hardcoding a specific destination key rather than using environment variables or user configuration is a significant security risk that functions as a 'phone-home' mechanism for sensitive development activity.