Project Watcher

项目规划与进度追踪。维护 roadmap，git commit 通知，远程部署感知，与飞书集成。

This skill is coherent with its description but review and control how you provide credentials and install hooks before using it: - send_card.py will send git commit metadata (repo, branch, short hash, commit message) to Feishu. You must supply FEISHU app_id/app_secret (via env vars FEISHU_APP_ID/FEISHU_APP_SECRET or by editing configs/feishu.json). Do not commit real secrets to repos. - The post-commit hook will run only if you put scripts/post-commit-hook.sh into .git/hooks/post-commit. Installing hooks is a manual action — don't copy hooks from untrusted code without review. - Example configs/projects.yaml references an SSH private key path. This repository does not use that key, but if you extend the skill to perform remote deploys, avoid placing private keys in project repos or shared config files. - Confirm the Feishu app has only the scopes you expect and that you trust the receive_id/open_id being used. Consider creating a dedicated Feishu app account with limited permissions for notifications. - If you need higher assurance, inspect send_card.py yourself; it uses the official Feishu endpoints and no obfuscated code was found. Given these checks, usage is reasonable. If the registry metadata should have declared required env vars, ask the publisher to update it before installing to avoid surprises.

Type: OpenClaw Skill Name: project-watcher Version: 1.0.0 The skill bundle contains a hardcoded Feishu recipient ID (ou_303e303666b03ee6300a4944c8d77d16) in 'scripts/post-commit-hook.sh', which would cause git commit metadata to be sent to a specific external account by default. Additionally, 'configs/projects.yaml' contains hardcoded paths to sensitive SSH private keys and remote host credentials. While these elements support the stated goals of project tracking and remote deployment, the hardcoded identifier and insecure credential management represent significant privacy risks and potential data leakage.