Web-to-FIM | 网页内容转 Markdown/飞书/IMA

将任意网页链接或本地文件一键转为结构化 Markdown，并保存到 Obsidian Vault、飞书云文档或腾讯 IMA 笔记。 支持的信源：(1) X/Twitter 推文、长文 Article、Thread 线程；(2) 微信公众号文章； (3) 小红书笔记；(4) 微博；(5) YouTube 视频；(6...

What to check before installing/using this skill: - Credentials: The package needs FEISHU_APP_ID/FEISHU_APP_SECRET and IMA_CLIENT_ID/IMA_API_KEY to push to those cloud services; only provide them if you trust this code and the destination service. If you only want local Obsidian export, use the --no-feishu and --no-ima flags and avoid setting those env vars. - Inconsistencies to fix: The registry metadata at the top claims no required env vars while SKILL.md and _meta.json require them. requirements.txt shipped with the package omits 'markitdown' even though the code depends on it — install markitdown (pip install markitdown) before running. - External script execution: If you feed Twitter/X links, web_to_md.py will try to run a fetcher at ~/.aily/workspace/skills/x-tweet-fetcher/scripts/fetch_tweet.py. That file is external to the skill and will be executed via subprocess. Only clone the x-tweet-fetcher repo (or place any script) into that path after auditing it. Consider editing web_to_md.py to point to a vetted fetcher path or avoid using the external fetcher. - Run safely: Test the scripts in an isolated environment (temporary VM or container) first. Use least-privilege for credentials, rotate keys after testing, and do not place production credentials into a .env or repository. Verify OBSIDIAN_VAULT_PATH points to a directory you control and that the skill’s file writes are acceptable. - Code review highlights: The network endpoints used are the documented Feishu/IMA APIs. No obvious secret-exfiltration endpoints are present in the shipped code, but be mindful that arbitrary remote content is fetched and then uploaded to cloud APIs you authorize — check what content you submit. If you want, I can: (1) point out exact lines that call subprocess.run and where to change the fetcher path, (2) produce a checklist to harden usage (safe env var handling, sandboxing), or (3) run a quick diff-style audit of the Python files to highlight potential bugs (e.g., the Feishu create_document URL string appears to have a formatting bug for returned URL).

Type: OpenClaw Skill Name: web-to-fim Version: 2.2.0 The skill bundle provides a legitimate utility for converting web content (URLs) and local files into structured Markdown and syncing them to Obsidian, Feishu, or Tencent IMA. The code follows security best practices by using environment variables for API credentials (FEISHU_APP_ID, IMA_API_KEY) rather than hardcoding them, and it uses safe subprocess execution with list-based arguments in scripts like web_to_md.py to prevent shell injection.