push-task-to-negative-screen

通用任务结果推送器，当任务完成后将结果推送到负一屏。使用统一的标准数据格式，支持各种类型的任务结果推送。

Key things to consider before installing: 1) The SKILL.md claims no credentials are needed, but the code reads a local .xiaoyienv and OpenClaw global config to obtain PERSONAL-API-KEY and PERSONAL-UID and then sends them as request headers — confirm where those files/keys come from in your environment. 2) The client uses a hard‑coded remote endpoint (https://lfhagmirror.hwcloudtest.cn:18449/...), so data will be sent there unless you audit and change the code; the skill does not make the full credential/endpoint usage obvious. 3) The code prints the key values when it finds them (stdout/log), which can leak secrets into logs; search the code for read_xiaoyienv and avoid using sensitive credentials if you cannot change that behavior. 4) If you still want to use it: run in a controlled environment first (dry-run), inspect/modify hiboards_client.py to remove printing of secrets and to make the endpoint configurable, set save_records=false and rotate or avoid storing sensitive content in task_content, and verify all outgoing network targets. 5) If you cannot or do not want to modify the code, do not provide real production credentials or place them in ~/.openclaw/.xiaoyienv; instead, use a sandbox account or a local endpoint for testing. 6) Because documentation and code disagree about authentication, treat this skill as untrusted until you perform the above audits.

Type: OpenClaw Skill Name: push-task-to-negative-screen Version: 1.0.21 The skill is a task notification tool designed to push markdown content to Huawei's 'Negative Screen' (Celia/Hiboards) service. It functions by reading local authentication credentials (API keys and UIDs) from a specific environment file (`.xiaoyienv`) and transmitting them along with task data to a hardcoded Huawei cloud endpoint (`hwcloudtest.cn`). While the handling of local credentials and external network communication are high-risk capabilities, they are explicitly documented in `SKILL.md`, `README.md`, and `SECURITY.md`, and are strictly aligned with the stated purpose of the skill. No evidence of obfuscation, unauthorized data exfiltration, or malicious prompt injection was found.