敏感内容处置器

支持关键词脱敏、文件加密和水印添加，对扫描出的敏感内容进行合规处置并可发送通知，需先使用敏感内容扫描器。

This package appears to do what it says (redact and encrypt files and send notifications), but you should be cautious before running it on sensitive data: - Review the code before use: the encryption implementation uses PBKDF2 to derive a key but then XORs file bytes with that key (weak, nonstandard encryption). Do not rely on it for high-sensitivity data. - The tool records and can send the encryption password in the result metadata and in webhook notifications. Only configure trusted webhook endpoints and avoid sending passwords unless you accept that exposure. - Back up original files before running; the tool can overwrite originals if --overwrite is used. - Install dependencies locally in an isolated environment (virtualenv) using requirements.txt; inspect any network calls the script makes (requests usage) and only point webhooks to trusted URLs. - If you need stronger guarantees, replace the encryption routine with a well-reviewed library (e.g., use standard AES/GCM tooling) and remove sending of passwords in notifications. Confidence is medium because the provided script listing was truncated; review the full scripts/disposal.py before trusting it with sensitive production data.

Type: OpenClaw Skill Name: sensitive-content-disposal Version: 1.2.0 The skill provides legitimate utility for redacting sensitive PII (Personal Identifiable Information) and encrypting files across various formats including Office documents and PDFs. The implementation in `scripts/disposal.py` uses standard regex patterns for identifying sensitive data and a basic XOR-based encryption scheme. While the encryption method is cryptographically weak and the notification feature sends sensitive data (like passwords) to user-configured webhooks (Feishu/WeCom), these behaviors are consistent with the stated functionality and do not exhibit signs of intentional malice, hidden exfiltration, or prompt injection.