pms-worklog

自动填写 PingCode/PMS 系统工时记录。支持批量填写多天的工时，自动登录、选择事项类型、填写事项、工时、日期和说明。

This skill appears to do exactly what it says: control a Chrome browser via Playwright to log into your PingCode/PMS and submit worklog entries. Before running it: (1) review the full script to ensure there are no outbound network calls or telemetry (the visible code only manipulates the browser and saves local screenshots); (2) do not hardcode real credentials in the file — prefer exporting PMS_USERNAME/PMS_PASSWORD in your shell or a secure secrets store; (3) update screenshotDir and any user-specific paths to a safe location you control; (4) be aware the SKILL.md asks you to install Playwright globally and download Chromium (this will use network bandwidth and write browser binaries to disk); (5) run the script first in a test account or sandbox to confirm behavior (it will drive a real browser and can interact with any site the browser can reach); (6) because the package owner is unknown and source/homepage are missing, treat it like untrusted code: inspect it thoroughly and consider running under a restricted account or container. If you want, I can scan the rest of the truncated script for additional network or data-exfiltration calls — provide the full file and I'll re-check.

Type: OpenClaw Skill Name: pms-worklog Version: 1.0.0 The skill is a legitimate automation tool designed to fill worklogs on the AISpeech PMS system (pms.aispeech.com.cn) using Playwright. The script (scripts/fill_worklog.js) handles authentication and form submission as described in SKILL.md, and while it manages sensitive credentials and takes local screenshots for debugging, its behavior is transparent and strictly limited to the stated purpose. No evidence of data exfiltration, unauthorized remote access, or malicious intent was found.