meego-skill

飞书项目（Meego）全能力技能。提供工作项查询、状态流转、团队管理、工时统计、评论协作等全部能力。当用户提到以下场景时激活：查询在途工作项、查缺陷/任务/需求详情、查团队成员、查工时记录、添加评论、创建工作项、修改工作项字段、查询工作项流转状态、查成员排期、查询视图和图表、查询工作项字段配置、查询项目空间信息、...

Do NOT paste your ~/.mcporter/credentials.json (or any OAuth tokens) into chat. The SKILL.md explicitly asks you to paste credentials for the assistant to write into /root/.mcporter/credentials.json — that creates a direct credential-exfiltration risk. Safer options: (1) perform the npx auth step directly on the target server or on a secure admin workstation so tokens are written locally and never shared in chat; (2) if you must use this skill, create a scoped/limited service account or ephemeral token with minimal permissions and rotate it immediately; (3) verify the npm package @lark-project/meego-mcporter provenance and audit its code before installing; (4) prefer secure copy (scp/sftp) or a secrets manager to move credentials to servers rather than pasting into chat; (5) if you already shared tokens here, rotate/revoke them immediately. The skill's functionality itself matches its description, but the credential-handling instructions are unsafe — treat them as a blocking concern unless you change to a secure transfer workflow.

Type: OpenClaw Skill Name: meego-skill Version: 2.2.0 The meego-skill bundle is a comprehensive integration for Feishu Meego project management, utilizing the `meego-mcporter` CLI tool via the Model Context Protocol (MCP). The documentation in SKILL.md provides transparent instructions for OAuth authorization and tool configuration, including a step where the user provides credentials for the AI to save to `/root/.mcporter/credentials.json`. While the skill involves sensitive token handling and shell command execution, all behaviors are strictly aligned with its stated purpose of managing work items, schedules, and team data within the Feishu ecosystem, with no evidence of malicious intent or unauthorized data exfiltration.