百科虾

蜗牛公司百科虾技能包。为员工解答公司相关问题（制度、福利、流程、组织架构等）。当用户询问公司相关问题时触发。知识库没有的问题一律不答，不编造，不联网搜索。

This skill appears to do exactly what it says: sync Feishu wiki pages into an agent-local cache, build a search index, and send replies via Feishu. Before installing, confirm the following: (1) openclaw.json in the operator's home (~/.openclaw/) will be read for Feishu appId/appSecret — only provide credentials that are scoped to this agent/app. (2) The skill logs API responses (sync.js prints debug info) and may call contact APIs to resolve user names — those calls involve employee identifiers and names, so restrict who can run the agent and where logs are stored. (3) The scripts write cache and temp files under the agent workspace (e.g., cache/, temp/) — run in an isolated workspace to avoid accidental exposure. (4) Review wiki_list.json to ensure it only points to approved internal wikis. If you need stronger assurance, run the scripts in a controlled environment (no production credentials) and inspect logs/output during a sync to verify behavior.

Type: OpenClaw Skill Name: walter-baikexia Version: 2.2.1 The walter-baikexia skill bundle is a legitimate internal Q&A assistant designed to sync and search company knowledge from Feishu (Lark) Wikis. The bundle includes scripts for content synchronization (sync.js), BM25-based searching (search.js), and message delivery via the Feishu API (send-message.js). While the scripts access sensitive credentials (App ID and Secret) from the OpenClaw configuration, they only communicate with the official Feishu API (open.feishu.cn) to perform their stated functions. The instructions in SKILL.md and the role definitions (SOUL.md) are explicitly designed to restrict the agent to internal data and prevent hallucinations or unauthorized web searches. Although sync.js contains minor coding errors (e.g., undefined variables like WIKI_TOKEN), there is no evidence of malicious intent, data exfiltration, or prompt injection attacks.