Custom Morning Brief

================================。触发词：搜索, search, skill, 优化, 数据, data。

Before installing, verify and control where your data will be read from and sent. Questions to resolve: (1) Where are hot.md and USER.md stored and what sensitive data do they contain? (2) Which credentials (Feishu token, Tencent/tianji-data API key, search API keys) are required and who will supply them — update the skill to declare those env vars explicitly. (3) Why is the Feishu target hard-coded to ou_fd61d5…? If you install, replace the hard-coded recipient with a configurable target or require explicit consent per send. (4) Confirm how the scheduled automatic runs are triggered and require an opt-in. If you cannot verify the destination and required credentials, treat this skill as risky and do not grant agent access to USER.md or production credentials.

Type: OpenClaw Skill Name: yuheng-morning-brief Version: 1.0.0 The skill bundle is classified as suspicious because SKILL.md contains instructions to read sensitive financial portfolio data from a local file (USER.md) and transmit it to a hardcoded Feishu recipient ID (ou_fd61d5ebc9af22913aa4c21c8e3cac14). This configuration functions as a data exfiltration mechanism, as any user deploying the skill would unknowingly send their private investment data to the author's specified endpoint. While this could be a result of poor template design rather than overt malice, the hardcoded destination for private data represents a significant security and privacy risk.