Web To Feishu

将任意网页链接或本地文件一键转为结构化 Markdown，并保存到飞书云文档或腾讯 ima 笔记。 支持的信源：(1) X/Twitter 推文、长文 Article、Thread 线程；(2) 微信公众号文章； (3) YouTube 视频；(4) 任意 HTML 网页；(5) 本地文件：PDF、Word、PP...

This skill appears to do what it says, but take these precautions before installing or using it: - Only set FEISHU_APP_ID/FEISHU_APP_SECRET and IMA_CLIENT_ID/IMA_API_KEY for accounts you control; treat these like passwords and rotate if exposed. - The Twitter path requires an external repository (x-tweet-fetcher). Manually review that repository (its origin, code, network calls) before cloning and running it—it will be executed via subprocess and has access to network and file I/O. - Verify the third‑party Python package names: the SKILL.md mentions markitdown-plus but code imports markitdown; confirm which package you need and audit it before pip install. - Run the clients in a sandbox or non-production account the first time to verify behavior and endpoints (Feishu and IMA endpoints are in the docs, but double-check URLs and returned responses). - Be cautious when converting local files containing sensitive data: the tool will read and send content to external services (Feishu/IMA) if you choose to save there. - If you need higher assurance, request the upstream repository/homepage for x-tweet-fetcher and markitdown, and ensure the skill's references match the actual packages and locations. If anything in the external fetcher or markitdown package looks suspicious, do not run it with your credentials.

Type: OpenClaw Skill Name: web-to-feishu Version: 1.0.2 The skill bundle is a legitimate utility for converting web content and local files into Markdown and saving them to Feishu or Tencent ima. The code follows security best practices by using environment variables for API credentials (FEISHU_APP_ID, IMA_API_KEY, etc.) and avoids shell injection vulnerabilities in scripts/web_to_md.py by using list-based arguments with subprocess.run. No evidence of data exfiltration, malicious execution, or prompt injection was found.