Agent Factory (Walter)

创建新的 OpenClaw Agent 并自动配置飞书机器人。当用户说"帮我创建 Agent"、"新建机器人"、"添加新 agent"、"配置新机器人"时触发。用户提供：agent 名称、飞书 appId、appSecret、角色定位。执行完毕后汇报结果。

This skill will run commands that modify your OpenClaw installation and persist the provided Feishu appSecret into ~/.openclaw/openclaw.json, then restart the gateway. Before installing or running it: 1) Confirm you trust the author; 2) Manually review the SKILL.md steps; 3) Ensure openclaw, clawhub, curl/jq (or PowerShell) are installed and understand the commands will run with your user privileges; 4) Back up ~/.openclaw/openclaw.json and verify file permissions (secrets are stored in plain JSON); 5) Prefer to run the script interactively yourself rather than granting an automated agent permission to execute it, or at minimum run in a safe/non‑production environment; 6) If you plan to install a third‑party skill via clawhub, verify the skill name/source first. The metadata should be updated to declare required binaries and the sensitive nature of persisted credentials — treat the current omission as a red flag.

Type: OpenClaw Skill Name: walter-agent-factory Version: 2.1.1 The skill acts as an administrative tool to automate the creation of new agents, but it performs high-risk operations including modifying the core 'openclaw.json' configuration and handling sensitive Feishu 'appSecret' credentials. It is vulnerable to command injection in both the PowerShell and Bash scripts (SKILL.md) because it uses 'Invoke-Expression' and unsanitized variables to execute CLI commands. Additionally, it copies 'MEMORY.md' from the current workspace to the new one, which could lead to unintentional data leakage of sensitive conversation history between agents.