Feishu-integrated wrapper for the capability-evolver. Manages the evolution loop lifecycle (start/stop/ensure), sends rich Feishu card reports, and provides...

This skill contains substantial Node.js code (daemon/watchdog, filesystem and process manipulation, Feishu API callers) but the registry entry claims no required env vars and the SKILL.md lists only simple run commands. Before installing or running: 1) Review all code (especially index.js, lifecycle.js, report.js, export_history.js, issue_tracker.js) and confirm you are comfortable with it accessing your OpenClaw workspace, memory/, logs/, and assets/ files. 2) Do not provide Feishu tokens (FEISHU_APP_ID/FEISHU_APP_SECRET or FEISHU_EVOLVER_DOC_TOKEN) or OpenClaw credentials unless you trust the source; the code will read token files and call Feishu APIs. 3) Expect the skill to spawn background processes and write pid/log files; run it in an isolated/sandboxed environment or container if you want to limit host impact. 4) If you need to use it, minimize secrets given to it and prefer read-only tokens where possible; consider creating a dedicated Feishu app/account scoped only to reporting. 5) The package uses local paths and a local "evolver" dependency — ensure those paths match your setup or the code will try to access unexpected filesystem locations. Finally, because the metadata omitted required env variables and the code exercises system-level actions, treat this skill as higher-risk unless you can fully audit and sandbox it.

Type: OpenClaw Skill Name: feishu-evolver-wrapper-ganyu Version: 1.0.0 This bundle is a highly privileged lifecycle manager for an autonomous AI 'evolution' loop, integrating with Feishu for reporting and dashboarding. It exhibits several high-risk behaviors, including automated Git synchronization (add/commit/push), persistence via OpenClaw cron jobs and background daemons (lifecycle.js), and the ability to monitor and 'auto-heal' other skills (skills_monitor.js). A critical security risk is present in index.js, which uses a 'new Function' constructor to evaluate potentially untrusted, LLM-generated JSON payloads. While the bundle includes defensive features like a secret scanner (feishu-helper.js) to prevent credential leakage and circuit breakers to stop failing loops, the combination of broad shell execution and autonomous code modification capabilities warrants a suspicious classification.