每周依赖检查。检查 Node.js、npm 版本和全局包是否有可用更新。触发时机：cron 定时任务或手动调用。

This skill otherwise looks coherent for a dependency-checker, but it requires sending reports to Feishu while declaring no credentials or webhook. Before installing: 1) Confirm how messages will be sent — does your agent already have Feishu integration or will you need to provide a FEISHU_WEBHOOK / FEISHU_TOKEN? The skill should explicitly declare required env vars. 2) Verify you are comfortable with the skill running shell commands (node -v, npm -v, npm list -g, npm outdated) on the host and writing files to data/exec-logs; listing global packages can reveal installed packages. 3) Ask the publisher to clarify the exact delivery mechanism and to add explicit environment variable requirements and error-handling behavior. 4) If you want to limit risk, run the skill in a restricted environment (container or dedicated CI runner) and do not enable it for autonomous runs until you confirm the messaging credentials and delivery implementation. If the agent will use shared Feishu credentials, consider creating a dedicated Feishu webhook/account with limited scope.

Type: OpenClaw Skill Name: dependency-tracker Version: 1.0.1 The skill utilizes shell commands (e.g., `npm list -g`, `npm outdated`) to collect system environment data and instructs the agent to transmit this information to an external Feishu (Lark) endpoint. While these actions are consistent with the stated purpose of a 'Dependency Tracker' and the commands themselves are non-malicious, the combination of shell execution and network-based data exfiltration of system metadata meets the threshold for a suspicious classification under the provided security criteria (SKILL.md, references/spec.md).