Storage Manager

飞书收纳管家完整版 - 智能位置匹配 + 位置图片管理 + 一键入库

What to consider before installing: - Do not rely on the code's defaults. The package includes hard-coded Feishu credentials/tokens in several Python files; if you don't supply your own FEISHU_* environment variables, images and records will be uploaded to the account tied to those defaults. Treat that as potential data exfiltration. - Recommended immediate steps before use: 1) Inspect the code files (final_integrated.py, complete_system.py, location_image_manager.py, etc.) and remove or replace any hard-coded FEISHU_APP_ID / FEISHU_APP_SECRET / FEISHU_BITABLE_TOKEN / FEISHU_TABLE_ID values. Ensure they are not present in the deployed copy. 2) Provide your own Feishu credentials via environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_BITABLE_TOKEN, FEISHU_TABLE_ID) and verify the code reads them (it does, but defaults exist). Test with throwaway data first. 3) If you do not control the Feishu app the code would use (i.e., you don't know the owner of the hard-coded credentials), do not run the skill with real/personal images or sensitive data. 4) Consider running the tool in an isolated environment (container/VM) and monitor network calls (to confirm they go to your configured app and not elsewhere). 5) If you will install via the provided install.sh, review the script and remove or modify the symlink creation step if you prefer not to alter ~/.local/bin automatically. - If you are not comfortable auditing or editing the code, avoid installing this skill or request a version from the author that does not contain embedded secrets and that properly declares required environment variables in its metadata.

Type: OpenClaw Skill Name: storage-manager Version: 1.0.1 The skill bundle contains hardcoded sensitive credentials, specifically a Feishu App Secret ('HHEZEDoNZwfNdoediXiGSbaRFKDmpB71') and Bitable tokens, across multiple files including complete_system.py, final_integrated.py, and storage_manager_final.py. While these appear to be default or test credentials for a specific Feishu Bitable instance, hardcoding secrets is a critical security vulnerability. Furthermore, the SKILL.md instructions explicitly direct the AI agent to operate 'without user confirmation' for its smart matching logic, which increases the risk of unintended data modification.