提交缺陷信息到TeamCycle平台，支持缺陷全生命周期管理，含飞书多维表格和文档记录与查询功能。

This skill appears to perform the advertised task but has several red flags you should address before installing or using it: - Verify the 'bug-reporter' dependency: the SKILL.md points to a hard-coded local path (C:\Users\zhanju.zhang\...). Confirm that the referenced code exists on your system, inspect its source, and ensure it is trustworthy before allowing the agent to execute it. - Do not pass passwords on the command line: the example shows a plaintext password argument. That exposes credentials via process lists and logs. Prefer secure credential storage (environment variables, secret manager, or token-based auth) and confirm how the agent will obtain credentials. - Clarify Feishu authentication: the skill uses Feishu doc/bitable actions but declares no Feishu credentials. Ensure integration tokens are provided securely and that you understand where and how they are stored or transmitted. - Review allowed tools and local writes: the agent is permitted exec/read/write; audit any scripts it will run and confirm where local tracking files will be written. Be cautious if the skill will read other files or credentials on disk. - Origin and provenance: the skill's source/homepage is unknown. If you do not trust the author, do not install or run it until you can review the bug-reporter code and confirm endpoints and auth flows. If you want to proceed safely: obtain or implement a version that (a) uses token-based auth or secure env vars for TeamCycle/Feishu, (b) documents where credentials are stored, (c) avoids passing secrets on the command line, and (d) removes hard-coded user-specific paths or makes the dependency explicit and configurable.

Type: OpenClaw Skill Name: agent-bug-submission Version: 1.0.0 The skill is classified as suspicious due to insecure credential handling and hardcoded environment-specific paths. SKILL.md instructs the agent to execute a Python script (bug_reporter.py) using the 'exec' tool while passing a plaintext password as a command-line argument, which is a major security risk as it exposes credentials in process logs. Additionally, the skill references a hardcoded absolute path to a specific user's directory (C:\Users\zhanju.zhang\...) for its dependencies, which is highly unusual for a portable skill bundle and suggests it was designed for a specific, non-standard environment. The skill targets the TeamCycle platform at teamcycle.100credit.cn.