Travel Customizer

基于飞书多维表格的智能旅游行程定制助手，可生成、查询和管理旅行计划。

What to check before installing or enabling this skill: - Verify the upstream repository: confirm the GitHub URL in SKILL.md/README exists and that the code there matches the bundled code. The registry lists 'source: unknown' which reduces transparency. - Validate env var requirements: SKILL.md asks you to provide FEISHU_BASE_TOKEN, FEISHU_TABLE_ID, and (optionally) FEISHU_APP_ID/FEISHU_APP_SECRET, but the packaged code requires all four. Only provide App Secret if you trust the code and repository; prefer creating a Feishu app with the minimum required scopes and test with a throwaway account or test table. - Confirm claimed features vs implementation: README claims auto-deidentification and interactive confirmations; the shipped tools.py does not implement those. If you need those behaviors, request the author to provide matching code or patch the skill. - Protect PII: the tool transmits user name and phone to the Feishu table. If that is sensitive, verify privacy practices, or configure a test table that does not contain real customers before using with real data. - Least privilege: when creating the Feishu app, grant only the minimal bitable scopes required (e.g., record create) and avoid giving broader workspace credentials. Rotate secrets after testing. - If you lack confidence, run the skill in a restricted environment (sandbox/test workspace) and/or ask the maintainer for a signed/verified release or for the missing tool implementations (search/update/delete) before giving production credentials. Confidence would increase to benign if the publisher/source is verified, the registry env requirements are corrected to match runtime needs, and the repository code implements the declared tool functions and documented privacy safeguards.

Type: OpenClaw Skill Name: tcly-c Version: 1.0.1 The skill bundle is a legitimate integration for managing travel itineraries via Feishu Bitable. While there is a functional discrepancy between the tools defined in SKILL.md (create, search, update, delete) and the actual implementation in tools.py (which only contains submit_to_feishu), this appears to be a development oversight rather than a security risk. The code uses standard environment variables for Feishu API credentials and communicates only with the official Feishu endpoint (open.feishu.cn).