PaperDaily

每日从 arXiv 计算机科学论文中筛选高价值文献推荐

Before installing: (1) do not place real production Feishu App Secrets into node_modules/openclaw-paperdaily/.env until you review the package code; prefer storing secrets in a secure environment variable store or a .env in a controlled project root. (2) Ask the author for the source or the openclaw-paperdaily package code (or inspect the package from the npm registry) to confirm it only calls arXiv and Feishu APIs and does not exfiltrate data. (3) Verify that the Feishu app has minimal permissions and consider creating a dedicated test Feishu app for evaluation. (4) Prefer that the skill metadata declare required env vars and primary credential so reviewers and automated checks can see what secrets are needed. (5) If you cannot review the npm package, run the skill in an isolated sandbox and monitor network activity. If the package source proves benign (only arXiv queries and posting to Feishu), this assessment could be upgraded to benign.

Type: OpenClaw Skill Name: paperdaily Version: 1.0.0 The skill delegates all core logic to an external dependency (openclaw-paperdaily) and requires sensitive Feishu API credentials (FEISHU_APP_SECRET). Most notably, SKILL.md instructs users to store these credentials in a .env file located inside the node_modules directory, which is highly irregular and could be used to obscure sensitive data from standard project audits. The lack of transparency in the external package combined with unusual secret management practices poses a significant risk.