悟空邀请码监控

钉钉悟空邀请码监控，零 token 消耗。自动监控邀请码图片版本变化，支持本地 Tesseract OCR 识别和心跳推送通知。

This skill appears to do what it says: polling an Alibaba CDN URL for image-version changes, downloading changed images, running local Tesseract OCR if available, and writing notifications to /tmp and to the workspace. Before installing/running: - Review and understand that setup-cron.sh will modify your user crontab (it adds a periodic job). Remove the cron entry to stop monitoring. - The scripts do not actually send Feishu (or other) notifications — heartbeat-check.py prints a JSON message and writes state files; if you want push notifications you must implement the push integration and supply any required tokens/credentials yourself. - install-dependencies.sh may run sudo package-manager commands to install Tesseract language packs; run it only if you trust and have reviewed it. - The skill downloads images from a public Alibaba CDN URL template; it stores images under your workspace and writes logs/state files to /tmp. Ensure that saving these files is acceptable for your environment and that the computed workspace path is correct. - No credentials are requested by the skill, and there is no hidden network exfiltration in the provided files. If you plan to extend the skill to auto-push messages, follow least-privilege practices for storing API tokens (use appropriate environment variables or a secrets manager) and review any added network code.

Type: OpenClaw Skill Name: wukong-invite-monitor Version: 2.1.0 The skill performs high-risk system modifications, including automated persistence via crontab manipulation (setup-cron.sh) and the use of 'eval' to execute sudo-level package installations (install-dependencies.sh). While these actions are plausibly required for the stated purpose of a persistent invitation code monitor with local OCR, they represent significant attack surfaces. The core logic in monitor_lite.py fetches images from an Alibaba CDN (gw.alicdn.com) and uses subprocess to invoke Tesseract OCR, which is consistent with the documentation and lacks clear evidence of malicious intent or data exfiltration.