科技新闻日报

科技新闻日报技能。每日科技新闻热榜整理与报告生成。当用户说"科技新闻日报"、"整理今日科技新闻"、"生成科技新闻热榜"、"tech-news-daily"、"TechNews-Daily-Report"或类似表达时触发。功能包括：(1) 使用 Tavily 搜索引擎近7天科技/AI 新闻进行搜索；(2) 按相关度...

This skill appears to do what it claims (collect tech news and publish it), but the SKILL.md contains explicit Feishu group/chat IDs and example tokens and requires writing local checkpoint files — all without declaring Feishu/Tavily credentials. Before installing or enabling it, verify the following: (1) Confirm that any hard-coded IDs (chat: oc_d591432..., space_id, node_token, etc.) belong to *you* or are safe — if not, the skill will send reports to an external group. (2) Require the skill to request explicit Feishu credentials or to use only the user's authenticated session (do not accept hard-coded tokens). (3) If you allow local file writes, check where files are stored (memory/YYYY-MM-DD-tech-news.md and checkpoint JSON) and whether those files may include sensitive content. (4) Consider running this skill in a sandboxed or test environment first and monitor outbound messages. (5) If you need a safer alternative, remove/replace hard-coded endpoints and require explicit user confirmation before sending any messages to Feishu groups.

Type: OpenClaw Skill Name: tech-news-daily-cn Version: 0.2.4 The skill contains hardcoded Feishu (Lark) identifiers, including a specific Chat Group ID (oc_d591432cedf9a00c01878c24754cb050), Space ID (7621391289904516315), and Owner Open ID (ou_d8ace8a146610ca26bc07d8e68a5620f) in SKILL.md and references/feishu-doc.md. While the primary logic is for tech news aggregation, hardcoding these destination tokens instead of using dynamic parameters or environment variables is a security risk, as it directs the agent to send its output to specific, pre-defined external endpoints that may not be under the user's control.