Super Lobster

🦞 Super Lobster | 超级龙虾 - 桥哥的私人 AI 助理 整合了飞书文档管理、会议纪要整理、每日待办推送、工作模块分类等核心技能。 能够自动读取会议纪要、按工作模块分类整理待办事项、创建飞书文档并推送。 核心能力： - 📄 飞书文档创建（支持 100+ blocks 大文档） - 📋 会议纪...

Do not run or install this skill as-is. The code includes embedded Feishu credentials (APP_SECRET/APP_ID/USER_OPEN_ID) that should never be committed to a public or shared repo. Before using this skill: 1) Ask the author to remove hard-coded secrets and to accept credentials via environment variables or a secure platform secret manager; 2) Rotate any exposed credentials immediately (treat the included APP_SECRET as compromised); 3) Verify the repository's origin and the author's identity (there is a github link in metadata—confirm it exists and matches the published package); 4) Review and restrict the Feishu app permissions to the minimum necessary (docx write, permission manage, message send are powerful); 5) Run the code in an isolated/test environment and inspect other scripts (read_meeting_notes.mjs, classify_by_module.mjs) before granting it access to real data; 6) If you need automated deployment, require the skill to document exactly which environment variables it expects and avoid any embedded credentials. These steps will reduce the risk of credential exposure or unintended data access.

Type: OpenClaw Skill Name: wong-super-lobster Version: 1.0.0 The skill bundle contains hardcoded sensitive credentials, specifically a Feishu 'APP_SECRET' and 'USER_OPEN_ID' within 'scripts/create_daily_todo.mjs' and 'clawhub.json'. The script is designed to automatically grant 'edit' permissions to the hardcoded 'USER_OPEN_ID' for any documents it creates. While this appears to be a poorly secured private tool rather than intentional malware, the exposure of API secrets and hardcoded access control mechanisms represent significant security vulnerabilities.