Openclaw San Sheng Liu Bu Lobster

支持接收任务分配，通过子代理执行，发送飞书通知，创建文档，多维表格记录并汇总成果交付的一人公司部署工具。

This skill largely does what its description says (orchestrates subagents and automates Feishu document/table updates), but there are important red flags to check before installing: - The files contain a hardcoded Feishu app/table token, table_id and several OpenIDs/group IDs. Verify whether those tokens are placeholders or active credentials. If they are real, they expose access to someone else's Feishu resources or leak your credentials if you replace them incorrectly. - The registry metadata declares no required env vars, yet the skill clearly needs Feishu credentials to operate. Ask the author to clarify how Feishu authentication is meant to be provided (platform-managed credentials vs. secrets in files). Prefer supplying credentials via secure env vars or the platform's secret store — never store tokens in plaintext in skill files. - The SKILL.md references a user-specific local path (/Users/laihehuo/...). That path is likely a leftover from the author's environment; confirm that file paths will be configurable and that the skill won't attempt to read arbitrary local files you don't want exposed. - sessions_spawn with cleanup='keep' will persist subagent sessions. If you allow autonomous invocation, consider limiting permissions for spawned subagents and audit what they may access. Recommended actions before installing: obtain author guidance about credential handling; remove or rotate any exposed tokens; replace hardcoded tokens/IDs with configuration placeholders; run the skill in a restricted/test environment first; and restrict the Feishu app's permissions (least privilege) and rotate credentials if you suspect the tokens in the repo are live.

Type: OpenClaw Skill Name: openclaw-san-sheng-liu-bu-lobster Version: 0.1.0 The skill bundle contains multiple hardcoded, environment-specific absolute file paths (e.g., `/Users/laihehuo/...` in SKILL.md) and specific Feishu (Lark) API identifiers, including an `app_token` (HxULbN8KTaIkCxsTmvYcg4ldnhh), `table_id`, and several `open_id` values in config/lobster-team.md. These hardcoded values create a high risk of data leakage, as the agent may inadvertently exfiltrate user task data to the developer's Feishu instance or fail to execute correctly on different systems. While likely a result of poor generalization rather than intentional malice, the presence of hardcoded external endpoints for data submission is a significant security concern.