MiniMax Feishu Music

Generate themed music with lyrics using MiniMax music-2.6 and send as a high-quality MP3 audio attachment to a Feishu user.

This skill's purpose (generate music and send to Feishu) is reasonable, but the helper script reads your OpenClaw config (~/.openclaw/openclaw.json) to pull Feishu app_id/app_secret without documenting that behavior — that file may contain sensitive credentials. Before installing or running: 1) verify the author/source (unknown here); 2) inspect ~/.openclaw/openclaw.json to confirm what secrets are stored and whether you want them accessed; 3) consider running the script in an isolated environment or sandbox; 4) ask the maintainer why the script fetches Feishu credentials directly (the script also calls openclaw CLI to send the file, so direct credential use looks redundant and may be a bug); and 5) if you don't want the skill to access your OpenClaw credentials, modify the script to rely solely on the openclaw CLI or explicitly document and approve the credential use. If you cannot validate the source or reason for the extra access, avoid installing or running this skill with real credentials.

Type: OpenClaw Skill Name: minimax-feishu-music Version: 1.4.0 The skill script `send_feishu_music.py` contains a path traversal vulnerability in the `save_to_workspace` function, as it uses the user-provided `--title` argument to construct a file path without sanitization, potentially allowing arbitrary file writes. Additionally, the script accesses the main OpenClaw configuration file (`~/.openclaw/openclaw.json`) to extract sensitive Feishu credentials (appId/appSecret), which is a high-privilege action. While these behaviors support the stated goal of generating and sending music, the lack of input validation and broad access to system secrets pose a security risk in an agentic environment.