by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions expect Feishu bot credentials and to read an agent config file (openclaw.json), but the package declares no required credentials/files and the referenced runtime .py files/configs are missing — these mismatches are concerning.
评估建议
Do not install this skill yet. Ask the author for: (1) the missing Python files (coordinator.py, feishu_sender.py) and config.json so you can inspect their logic; (2) a clear list of every credential or config file the skill will read (it currently references openclaw.json but declares nothing); (3) confirmation of where openclaw.json lives and what other secrets it contains. Only proceed if the code is available for review and the skill limits itself to only the Feishu bot credentials it needs ...详细分析 ▾
⚠ 用途与能力
The stated purpose (spawn multiple Feishu Bots) legitimately requires Feishu app_id/app_secret values and a config path; however the skill metadata declares no required environment variables or credentials. SKILL.md references config.json and also says Bot credentials are read from openclaw.json channels.feishu.accounts — a platform config path that was not declared. This lack of declared credentials is incoherent with the described functionality.
⚠ 指令范围
Runtime instructions tell the agent to run Python scripts (coordinator.py, feishu_sender.py), read config.json and openclaw.json for Bot credentials, and send messages as multiple bot identities. Those files are not actually included in the package. Instructions also direct reading the agent/platform config (openclaw.json), which is outside the skill's declared surface and could expose other accounts — this broad file access is a red flag.
ℹ 安装机制
There is no install spec (instruction-only), which is lower risk for arbitrary code installation. However package.json lists files (feishu_sender.py, coordinator.py, config.json) that are not present in the published bundle; that mismatch reduces confidence and suggests the SKILL.md was written for a different package layout.
⚠ 凭证需求
The skill declares no required env vars or primary credential, yet the instructions require app_id/app_secret for multiple bots and explicitly say bot credentials are read from openclaw.json. Requesting access to platform/agent config without declaring it is disproportionate and could enable exfiltration of unrelated credentials stored there.
ℹ 持久化与权限
always:false (no forced permanence) and normal autonomous invocation settings. Autonomous invocation combined with the skill's implied access to platform credentials (openclaw.json) increases risk, but persistence/privilege flags themselves are not elevated.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/13
- Initial release of Bot Roundtable Discussion skill. - Enables multiple bots to simulate a group discussion in Feishu chats, appearing as different expert perspectives. - Supports automatic and manual discussion triggers with customizable bots for flexible analysis and debate. - Includes configuration file for managing multiple bot credentials. - Requires Python 3.8+ and Feishu Open Platform apps.
● 无害
安装命令 点击复制
官方npx clawhub@latest install bot-roundtable
镜像加速npx clawhub@latest install bot-roundtable --registry https://cn.clawhub-mirror.com
技能文档
多Bot圆桌讨论系统 - 让飞书群里的多个Bot像真人一样讨论问题。
功能
- 单个Bot收到问题，自动spawn多个专业分脑
- 各分脑通过不同Bot身份发送到群聊
- 群里呈现多Bot讨论效果，像真人群聊
触发词
- "讨论 XXX"
- "大家怎么看"
- "多角度分析"
- "辩论 XXX"
使用方法
自动触发
在飞书群里说"讨论 XXX"即可自动触发手动调用
python skills/bot-roundtable/coordinator.py "讨论问题"
手动spawn
from feishu_sender import send_message_as_bot# spawn分脑
sessions_spawn(label="tech", task="技术专家分析：XXX")
sessions_spawn(label="product", task="产品专家分析：XXX")
# 发送结果
send_message_as_bot("qiwang", chat_id, "技术观点...")
send_message_as_bot("meidou2", chat_id, "产品观点...")
文件结构
bot-roundtable/
├── SKILL.md # 本文件
├── feishu_sender.py # 飞书多Bot发消息模块
├── coordinator.py # 协调脚本
├── config.json # Bot凭证配置
└── README.md # 详细文档
配置
config.json:
{
"bots": {
"default": {"app_id": "...", "app_secret": "..."},
"qiwang": {"app_id": "...", "app_secret": "..."},
"meidou2": {"app_id": "...", "app_secret": "..."}
},
"group_chat_id": "oc_xxx"
}
依赖
- Python 3.8+
- 飞书开放平台应用（需配置 app_id + app_secret）
注意事项
- 每条消息间隔0.5秒，避免频率限制
- 消息300字以内
- Bot凭证从 openclaw.json 的 channels.feishu.accounts 读取
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制