飞书智能日历调度器 - 自动推荐最佳会议时间，批量管理日程，生成会议报表

What to do before installing or running this skill: - Don't run install.sh or any script without inspection and, ideally, in a sandboxed environment (container or VM). The installer writes to $HOME/.openclaw and creates command aliases. - Confirm Feishu integration: the SKILL.md promises Feishu calendar actions, but the included runtime code (recommend.py) only implements a local recommendation algorithm and does not call Feishu APIs. If you need actual Feishu operations (creating meetings, sending invites), ask the author for the integration code or for explicit instructions on how credentials are provided (the skill expects a separate OpenClaw Feishu plugin). - Inspect and remove/rotate secrets: scripts/api_publisher.py contains a hard-coded TOKEN constant. Treat this as suspicious — do not run this publisher script until you verify the token's origin and intent. The license manager writes/reads a '.license_secret' file and returns the secret in some outputs; ensure secrets are stored securely and not published accidentally. - Avoid running the publisher/packager utilities unless you understand what they upload. api_publisher.py can upload local files to an external endpoint (clawhub.ai) using the embedded token — this could exfiltrate files from the skill directory if executed. - If you intend to use the license system, initialize and inspect the secret key handling (run license_manager init in a controlled directory), and do not allow the secret to be committed or uploaded. - If uncertain, request the upstream/source authorship and verification (the registry 'source' is unknown). Prefer skills with clear source repositories and no embedded tokens. If you proceed, run the code in an isolated environment and review all files that will be written to your home directory.

Type: OpenClaw Skill Name: feishu-calendar-scheduler Version: 1.0.0 The skill bundle appears to be a legitimate tool for Feishu calendar management; however, it contains a significant security vulnerability in 'scripts/api_publisher.py', which includes a hardcoded API token ('clh_SspeysnDJXJ0Zrwogveq8J07pC3cI1J_lY7_kT4DAZs'). While this is likely a developer oversight rather than intentional malice, the exposure of credentials and the inclusion of internal development tools like 'scripts/packager.py' in a distribution bundle are high-risk practices. The core logic in 'scripts/recommend.py' and the installation script 'install.sh' do not exhibit overtly harmful behavior.