Mermaid 转飞书图片 Canvas 渲染版

自动将 Mermaid 代码通过浏览器 Canvas 渲染为 PNG 图片并上传发送到飞书对话，实现图表可视化展示。

This skill appears to do what it says — render Mermaid and send images to Feishu — but take these precautions before installing: - Confirm the skill actually needs Feishu app_id/app_secret and only grant an app with the minimal permissions required; prefer using a short-lived token or app with limited scope. - The registry metadata does NOT declare the required env vars; treat that as a red flag and verify SKILL.md before supplying credentials. - Avoid storing app_secret in plaintext under ~/.agents/skills unless you control the machine and understand the file's permissions; prefer environment variables or a secure secret store if available. - Review any scripts (send-mermaid.py or similar) placed in your ~/.agents/skills directory before running them — the SKILL.md shows subprocess usage and file writes which can be abused if modified. - If possible, run initial tests in a sandboxed agent environment and monitor network requests to ensure images are only uploaded to Feishu and no unexpected external endpoints are contacted. - If you are unsure, ask the skill author for an updated manifest that declares required env vars and provides a signed/hosted script or code repository for review.

Type: OpenClaw Skill Name: mermaid-to-feishu Version: 2.0.1 The mermaid-to-feishu skill bundle is designed to render Mermaid diagrams into images and send them to Feishu (Lark) via its API. The skill provides two legitimate workflows: using the OpenClaw browser tool for Canvas-based rendering and a Python script (send-mermaid.py) that utilizes mermaid-cli (mmdc). The code snippets and instructions in SKILL.md are consistent with the stated purpose, using standard libraries like requests for Feishu API interaction (open.feishu.cn) and tempfile for secure intermediate file handling. No evidence of data exfiltration, unauthorized execution, or malicious prompt injection was found.