by 安全扫描
OpenClaw
可疑
medium confidence该技能的指令、要求和行为与飞书日历助手一致，它使用mcporter CLI调用MCP日历和联系人服务；没有请求或描述的内容看起来与该目的不成比例。
评估建议
此技能对于使用mcporter CLI管理飞书日历是连贯的，但在安装/使用之前采取这些预防措施：- 仅从受信任来源安装mcporter（验证npm包及其维护者），并自己运行安装，而不是运行您不理解的任意安装命令。- 该技能要求您粘贴飞书MCP服务的Streamable HTTP URL；将这些URL视为潜在敏感（它们允许mcporter客户端调用您组织的MCP端点），仅在您信任端点和操作员时提供它们。- 因为技能依赖外部CLI（mcporter），请审查mcporter关于本地存储内容（配置、令牌）及其网络行为的文档。- 注意小的不一致：package.json将mcporter列为依赖项，即使技能没有自动安装；这可能是打包遗漏，不是恶意的，但在授予生产账户访问权限之前验证。如果您想要更严格的审查，请提供mcporter包来源（或其代码），以便可以检查其网络/存储行为——如果它显示意外的外泄或广泛的本地凭证访问，该信息将改变评估。...详细分析 ▾
ℹ 用途与能力
Name/description match the code: the repository contains multiple scripts to list/search/create/sync Feishu calendar events and to create shared calendars. Requiring FEISHU_APP_ID and FEISHU_APP_SECRET is consistent with that purpose. However the published registry metadata claims no required env vars while the code and SKILL.md clearly require FEISHU credentials (and one script references OPENCLAW_MASTER_ID). That mismatch is an incoherence the maintainer should fix.
⚠ 指令范围
SKILL.md instructs running the provided node scripts and documents FEISHU_APP_ID/FEISHU_APP_SECRET in .env, which is consistent. But the code goes beyond passive reads: it creates and deletes calendar events (see cleanup.js and setup_routine.js), creates shared calendars and adds ACL members (setup_shared.js), and writes to local files (memory/calendar_events.json and HEARTBEAT.md in sync.js). search_cal.js references OPENCLAW_MASTER_ID but SKILL.md doesn't document it. Also several files call ../common/time-helper.js which is not present in the manifest (runtime breakage risk). These behaviors are within calendar-management scope, but they are high-impact actions (deleting events, making calendars public, adding members, scheduling recurring 'maintenance' events) and should be explicitly disclosed and gated.
ℹ 安装机制
There is no explicit install spec (instruction-only), which is low risk for automatic installs. The package.json and package-lock.json declare standard npm deps (@larksuiteoapi/node-sdk, dotenv). No downloads from arbitrary URLs are present. Users will need to run npm install to satisfy dependencies; that's expected but should be done from a trusted environment.
⚠ 凭证需求
The code requires FEISHU_APP_ID and FEISHU_APP_SECRET (documented in SKILL.md) but the skill registry lists no required env vars — a mismatch. Additionally search_cal.js reads OPENCLAW_MASTER_ID which SKILL.md and registry do not mention. Requesting Feishu app credentials is appropriate for calendar management, but missing/undocumented env vars and the ability to act on calendars (delete events, add members, create public recurring events) elevate risk and should be documented and constrained.
ℹ 持久化与权限
always:false (normal). The skill does persist and modify local files (memory/calendar_events.json, HEARTBEAT.md) and creates/deletes events on Feishu. Those actions are expected for a syncing/calendar-management tool, but they are privileged (they modify calendars and repo files). There is no evidence the skill modifies other skills or system-wide configuration, but the destructive operations (DELETE events) and creation of ACL entries are high-impact and require explicit confirmation from the user.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/14
初始版本，支持飞书日历操作
● 可疑
安装命令
点击复制官方npx clawhub@latest install feishu-calendar
镜像加速npx clawhub@latest install feishu-calendar --registry https://cn.longxiaskill.com
技能文档
Manage Feishu (Lark) Calendars. Use this skill to list calendars, check schedules, and sync events.
Usage
列表 Calendars
Check available calendars and their IDs.node skills/feishu-calendar/list_test.js
搜索 日历
Find a calendar by name/summary.node skills/feishu-calendar/search_cal.js
Check Master's 日历
Specific check for the Master's calendar status.node skills/feishu-calendar/check_master.js
同步 Routine
Run the calendar synchronization routine (syncs events to local state/memory).node skills/feishu-calendar/sync_routine.js
Setup
RequiresFEISHU_APP_ID and FEISHU_APP_SECRET in .env.Standard Protocol: Task Marking
Trigger: 用户 says "Mark task" 或 "Remind me 到...". Action:- Analyze: Extract 日期/时间 (e.g., "Feb 4th" -> YYYY-MM-04).
- Execute: Run
创建.js带有--attendees设置 到 requester's ID. - 格式:
node skills/feishu-calendar/create.js --summary "Task: