通过 GitLab API 查询并整理指定时间段内个人提交记录，自动生成规范的周报格式。

This skill mostly does what it says, but check a few things before installing or running it: - Credentials: The metadata does not declare that a GitLab token is required, yet the script needs a Personal Access Token. Treat that token as sensitive. Prefer providing it via a protected environment variable or a secure config file rather than on the command line. - CLI exposure: Running the script with --token will expose the token in process listings (ps). If other users share the machine, avoid passing secrets on the CLI. - GITLAB_URL: The script has GITLAB_URL set to an internal placeholder. Make sure it points to your intended GitLab instance and not an unexpected host. - Proxy bypass: The script calls curl with '--noproxy "*"' which forces direct connections and can bypass corporate proxies or monitoring — remove that flag if you need proxy or audit logging. - Hardcoded author: The code uses author_name="zhouyi" when querying commits. If you are not that user, edit/remove this to ensure correct results. - Transparency: The registry metadata should state the credential requirement (primaryEnv) so you clearly understand what will be needed. If you depend on this skill, request the maintainer update metadata and replace CLI token usage with a safer method. If you are comfortable editing the script: replace curl subprocess calls with an HTTP library (requests), accept token from env or prompt, remove '--noproxy', and remove or parameterize the hardcoded author. If you cannot review/edit the script, do not supply production tokens to it.

Type: OpenClaw Skill Name: gitlab-weekly-report Version: 1.0.0 The skill uses a Python script (gitlab_weekly_report.py) that executes system-level commands via `subprocess` to run `curl`. It includes risky configurations such as disabling SSL certificate verification (`-k`) and bypassing proxies, which are potential security vulnerabilities. Additionally, the script contains hardcoded user identifiers (e.g., `author_name="zhouyi"` and `user-id 46`) and instructs the agent to handle sensitive GitLab Personal Access Tokens, which could lead to credential exposure if not handled carefully within the OpenClaw environment.