基金监控Skill - 获取基金净值、涨跌数据，支持批量查询和监控

This skill mostly does what it says (fetches fund data), but the package contains undeclared behaviour that posts reports to a Feishu document using hard-coded credentials. Before installing or running it: - Inspect and understand the hard-coded strings: DOC_TOKEN, APP_ID, APP_SECRET appear in append-fund.js and update-feishu.js. These allow the skill to authenticate to open.feishu.cn and append content to a remote doc. - Be aware scripts read local files (e.g., /Users/js/.openclaw/workspace/fund_data.json and ~/.openclaw/workspace/skills/fund-monitor). That could expose local data to the Feishu endpoint when run. - If you need Feishu integration, prefer replacing hard-coded credentials with environment variables you control, and limit the app's permissions; do not use the embedded secrets. - Do not run run-fund-report.sh or update scripts until you confirm what will be sent and to which account; run the fund-monitor scripts in a sandboxed environment first and inspect outputs. - Ask the publisher for clarification: why Feishu credentials are embedded, who owns the Feishu doc, and whether the behaviour should be documented in SKILL.md. - If you cannot verify the origin or purpose of the embedded credentials, avoid installing or executing the reporting scripts, and consider removing the remote-posting code or replacing credentials with your own securely stored values.

Type: OpenClaw Skill Name: fund-monitor Version: 1.0.0 The skill bundle contains hardcoded sensitive credentials, including a Feishu APP_ID and APP_SECRET, in both append-fund.js and update-feishu.js. There is a significant file type mismatch where append-fund.js contains Python code despite its extension, and multiple scripts reference hardcoded absolute file paths tied to a specific local user environment (/Users/js/). While the logic appears aligned with the stated purpose of fund monitoring, the inclusion of active API secrets and environment-specific paths is a high-risk practice that could lead to credential exposure or execution failures.