Simple Management of Product Documents

Simple Management of Product Documents - A structured workflow for managing product documentation in Feishu (Lark). Use this skill when: - Creating a new pro...

Do not assume these embedded values are harmless examples. Before installing or using this skill: 1) Ask the author to remove any App Secret, access tokens, refresh tokens, or other credentials from the skill files and confirm whether the included values are placeholders or real. 2) If they are real, do not use them — those credentials should be rotated immediately by the owner. 3) Require the skill to declare any needed environment variables formally (e.g., FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_USER_TOKEN) instead of embedding secrets in docs, and prefer storing secrets in a secrets manager, not in documentation. 4) Verify whether your agent will ever autonomously call the Feishu APIs using any embedded tokens; if so, ensure tokens are yours, limited in scope, and revocable. 5) Consider treating the skill as untrusted until the credentials are removed or replaced with clearly labeled, non-privileged test values and until the author explains why credentials appear in the bundle.

Type: OpenClaw Skill Name: simple-product-doc-manager Version: 1.1.0 The skill bundle contains hardcoded Feishu API credentials, including an App ID, App Secret, and User Access Tokens, within 'references/feishu-api-setup.md'. While presented as an 'actual case' example, the inclusion of functional secrets in a skill bundle is a severe security risk. Additionally, 'SKILL.md' explicitly directs the AI agent to create and manage 'Configuration Records' documents intended to store sensitive information like API keys and environment variables. This combination creates a high risk of data exposure or credential harvesting if the provided 'example' credentials are used for real project documentation.