QQ邮箱发票下载器

自动登录QQ邮箱，按日期搜索发票邮件，下载PDF附件和解压ZIP，过滤非发票，生成分类Excel报告。

Do not run this skill as-is. Before installing or executing: 1) Search the code and remove/replace any hard-coded EMAIL and PASSWORD values — never run code that logs into someone else's mailbox. 2) Change BASE_DIR/OUTPUT_DIR to a configurable value (env var or CLI arg) so files are written to a safe location you control. 3) Inspect send_report.py / send_report_telegram.py to see whether and where results are transmitted; if you don't want external uploads, disable or remove those parts. 4) If you must use the skill, provide your own mailbox credentials via a secure mechanism (never embed them in the repo); run in an isolated VM and with a throwaway mailbox for testing. 5) Consider running a local static secrets scan and reviewing network endpoints the code contacts. If you are unsure or cannot confidently audit the code, avoid using it or request a version that accepts credentials and paths via documented, secure configuration.

Type: OpenClaw Skill Name: qq-invoice-downloader Version: 1.1.0 The skill bundle contains multiple hardcoded sensitive credentials, including a QQ email address and IMAP authorization code ([email protected] / dcdrfqjmoczrbhdj) and a functional Telegram Bot Token (8408048074:AAHRX5vogDUKZjdf-mL4ByJ8ukihRosqFpI) found in files like browser_processor.py and send_report_telegram.py. Most critically, send_report_telegram.py is designed to exfiltrate the generated '发票目录.xlsx' (which contains sensitive financial and personal data) to the hardcoded Telegram bot. While these are presented as reporting features, the use of hardcoded destination endpoints for sensitive data in a shared skill bundle is a significant security risk and resembles data exfiltration behavior.