小爱舆情结果飞书推送

从飞书多维表按规则筛选记录，格式化内容并自动推送到指定飞书群机器人Webhook，更新推送状态字段。

This skill appears to do exactly what it says: read a Feishu bitable view, filter records by a user-provided Python expression, post formatted messages to a Feishu group webhook, and mark records to avoid duplicate pushes. Before installing: (1) review and test with a small limit (e.g., limit=5) and a non-production Feishu app/space to confirm behaviour; (2) ensure the app_id/app_secret and webhook_url are for a dedicated service account you control; (3) be cautious with rule_expression you paste in — although the code restricts builtins, treat expressions as coming from trusted users; (4) review message_template and field contents to avoid inadvertently including malicious links or sensitive data in group messages; and (5) inspect the full push_skill.py (and scripts/push.py) if you need to be certain no additional network endpoints or logging of secrets are present.

Type: OpenClaw Skill Name: yuqing-push-skill Version: 1.1.0 The skill uses the 'eval()' function in 'push_skill.py' to evaluate the user-provided 'rule_expression' input. While it attempts to sandbox the execution by clearing '__builtins__', this is a known insecure pattern that often allows for Remote Code Execution (RCE). Additionally, the skill handles sensitive credentials (app_id and app_secret) and transmits data to external Webhook URLs, which, combined with the RCE vulnerability, poses a significant security risk despite the code appearing to follow its stated functional purpose.