One-stop enterprise AI assistant solution integrating Feishu and OpenClaw for quick deployment of smart customer service, group chat assistant, and workflow...

Before installing or running this skill: (1) Understand it requires Feishu App ID/Secret and an OPENCLAW_API_KEY even though the registry metadata doesn't list these — treat that as a red flag. (2) Review the included files yourself: deploy.py will auto-run pip installs if dependencies are missing and writes your app_secret into config.json in plaintext. Prefer setting OPENCLAW_API_KEY as an environment variable rather than embedding credentials in files. (3) Test in an isolated environment/container and do not use production credentials until you vet the OpenClaw and lark packages on PyPI (confirm the correct packages and versions). (4) Consider auditing the network endpoints (https://api.openclaw.ai/v1) and verifying the maintainer/contact info. (5) If you need this functionality but want lower risk: extract the minimal code you need, pin dependency versions, remove auto-install behavior, and avoid writing secrets to disk (or encrypt them / use a secrets manager).

Type: OpenClaw Skill Name: enterprise-ai-assistant-bundle Version: 1.0.0 The bundle provides a template for a Feishu (Lark) AI assistant but exhibits several high-risk behaviors and security anti-patterns. The `deploy.py` script uses `os.system` to install dependencies and requires users to provide sensitive credentials (`App ID` and `App Secret`) as command-line arguments, which are subsequently stored in plain text in `config.json`. Most notably, the script installs the `lark` package (a well-known parsing library) but `bot.py` attempts to import Feishu-related classes (e.g., `MessageManager`, `EventManager`) from it that do not exist in the legitimate library, suggesting either a broken implementation or a potential dependency confusion/typosquatting risk. Additionally, the `bot.py` script is incomplete, containing `TODO` markers for its primary message-sending functionality.