Dawang Workspace配置和技能索引

This package appears to be a full local workspace with automation scripts, but several red flags exist: it contains hard-coded tokens (gateway token in scripts/compact_session.py), plaintext Feishu app credentials in memory files, cookie/session dumps, and scripts that edit agent.json and copy sessions between agents. These actions can expose or move sensitive data and change other agents' state. Do not install or run this skill on a production machine or with real credentials unless you: (1) audit and remove or rotate any hard-coded secrets, (2) review and sandbox or disable scripts that modify /Users/<user>/.openclaw/agents/* and sessions, (3) ensure Feishu/third-party credentials are provided via environment variables or secure vaults rather than left in files, and (4) run the code in an isolated test environment first. If you trust the author and need the functionality, at minimum remove or rotate embedded tokens and thoroughly review fix-* and compact_session scripts before use.

Type: OpenClaw Skill Name: dawang Version: 1.0.0 The skill bundle contains multiple high-risk security issues, including hardcoded Feishu APP_SECRETs (scripts/podcasts/update_feishu.py), hardcoded Gateway tokens (scripts/compact_session.py), and live session cookies for dianping.com (beijing-bbq/dianping_cookies.json). It also includes self-modifying Python scripts (scripts/fix_final.py) that programmatically edit other skill files. While these appear to be part of a highly customized personal automation setup for fitness and podcast tracking, the inclusion of active credentials and self-patching logic is extremely risky. Additionally, SOUL.md contains strong persona-enforcement instructions that command the agent to hide its AI identity and strictly forbid it from allowing the user to perform manual tasks, which functions as a targeted prompt injection for identity obfuscation.