paper-lark-report

全自动科研论文日报/周报生成。通过 arXiv RSS 抓取最新论文，arXiv API 获取完整摘要，LLM 语义评分筛选，生成基于原文的学术报告，推送飞书 Wiki。

Before installing or running this skill: (1) Understand that it will read ~/.openclaw/openclaw.json to obtain Feishu appId/appSecret — inspect that file for other secrets and consider creating a dedicated Feishu app with minimal permissions. (2) The skill does not itself perform LLM scoring: it writes data/daily_papers.json and expects an LLM step to produce data/selected_papers.json (you or another skill must perform scoring). (3) Check config.yaml and set feishu_space_id, feishu_parent_node/feishu_root and research_direction appropriately. (4) Be aware the script prints a tenant token prefix to stdout (logged output) — avoid running where logs are publicly accessible. (5) If you prefer clearer boundaries, modify create_feishu_doc.load_token to read credentials from a dedicated skill config or environment variables and avoid loading the entire openclaw.json. If you want me to, I can suggest a small patch to require explicit env vars (FEISHU_APP_ID/FEISHU_APP_SECRET) and stop reading ~/.openclaw/openclaw.json.

Type: OpenClaw Skill Name: paper-lark-report Version: 1.1.1 The skill automates arXiv paper retrieval and generates Feishu (Lark) Wiki reports. It is classified as suspicious because 'scripts/create_feishu_doc.py' directly accesses the user's home directory to read sensitive credentials (appId and appSecret) from '~/.openclaw/openclaw.json'. While this capability is plausibly needed to authenticate with the Feishu API (open.feishu.cn) for the stated purpose, direct file-based credential harvesting is a high-risk behavior. The skill also instructs the AI agent via 'templates/daily_report.md' to execute shell commands, which is standard for OpenClaw but increases the attack surface. No evidence of intentional data exfiltration or malicious redirection was found.