by 安全扫描
OpenClaw
安全
high confidence该技能的文件、声明的要求和运行指令与 Openclaw 推送通道和 cron 作业的自我诊断/修复工具内部一致。没有请求无关的凭据或任意网络安装，但该技能会读取并（在明确确认后）修改本地配置和系统 crontab，因此请谨慎操作。
评估建议
该技能在诊断和修复 Openclaw 推送通道和 cron 任务方面是一致的，但它会读取您的 `~/.openclaw` 配置、日志和系统 crontab，并可以在确认后应用 crontab 编辑或重启服务。安装或运行前：（1）审查/备份您的 crontab 和 `~/.openclaw` 目录；（2）不要在聊天中粘贴令牌——按照技能的指导在终端中设置令牌；（3）注意小的不一致性，脚本使用 `~/.openclaw` 而不是遵守 `OPENCLAW_CONFIG_DIR` — 如果您在其他地方存储配置，请调整命令或路径；（4）仅在检查了提出的 crontab 差异并明确确认后允许去重/应用步骤。如果您想要额外的安全性，请先运行检查脚本（诊断模式），避免 `--fix/--dedup` 操作直到您感到舒适。...详细分析 ▾
✓ 用途与能力
Name/description match the scripts: checks Feishu (lark-cli), Telegram, WeChat bridge, and cron tasks. Declared binaries (curl, python3, pgrep, lark-cli, crontab) and optional env vars (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, OPENCLAW_CONFIG_DIR, FEISHU_APP_ID) are appropriate for the stated checks.
ℹ 指令范围
The SKILL.md and scripts instruct the agent/operator to read local files (~/.openclaw/*), inspect logs, run curl against Telegram APIs, check processes with pgrep, and (when fixing) export/edit/import system crontab lines and restart daemons. Those actions are within the tool's purpose, but they involve access to local state and potentially destructive crontab changes. Also: the SKILL.md declares OPENCLAW_CONFIG_DIR as an override, but most scripts hardcode ~/.openclaw instead of reading that env var — a minor inconsistency to be aware of.
✓ 安装机制
No install spec (instruction-only) and included scripts are prompt/guidance generators (they print shell steps). There is no download-from-URL or archive extraction. Risk from install mechanism is low.
✓ 凭证需求
No required secrets are demanded by the skill. Optional env vars (Telegram token/chat id, Openclaw config dir, Feishu app id) are reasonable and used in scripts. The skill explicitly warns not to paste tokens into chat and instructs the user to set tokens in their terminal — consistent with least exposure.
✓ 持久化与权限
Registry metadata shows always:false and metadata.openclaw.disable-model-invocation:true (skill will not be autonomously invoked by the model), which reduces autonomous risk. The skill's runtime guidance can modify the user's crontab and local configs, but actions that change crontab are gated behind explicit user confirmation per the scripts.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/4/5
修复：移除聊天中输入秘密的模式（永远不要要求用户在对话中粘贴令牌），在应用编辑前添加明确的 crontab 确认暂停
● 无害
安装命令 点击复制
官方npx clawhub@latest install openclaw-push-doctor
镜像加速npx clawhub@latest install openclaw-push-doctor --registry https://cn.clawhub-mirror.com
技能文档
一键诊断飞书断联、Telegram 无响应、定时任务失效 — 精准修复，不用从头重配
何时使用
- 飞书消息推不进来，或 lark-cli 命令报 401/token expired
- Telegram bot 长时间无响应，或需要重新验证配对码
- 微信 bridge 断线
- 定时任务（cron/push）静默失败，或同一任务重复触发
- 例行自检 — 每天/每周确认所有通道都活着
Scripts
| 脚本 | 用途 |
|---|---|
check-all.js | 全量诊断：所有通道 + 所有 cron 任务，输出健康报告 |
check-feishu.js | 飞书 lark-cli auth 状态、token 有效期、测试推送 |
check-telegram.js | Telegram bot API 连通性、webhook 状态、测试推送 |
check-wechat.js | 微信 bridge 进程状态、连接测试 |
check-crons.js | 列出所有定时任务、检测失败/重复/超时未跑 |
fix-feishu.js | 引导飞书 token 刷新或重新 OAuth 登录 |
fix-crons.js | 去重、修复、重启失效的定时任务 |
快速用法
# 全量自检（推荐先跑这个）
node scripts/check-all.js
# 只查飞书
node scripts/check-feishu.js
# 只查 Telegram
node scripts/check-telegram.js
# 只查定时任务
node scripts/check-crons.js
# 修复飞书 auth
node scripts/fix-feishu.js
# 修复 cron 重复任务
node scripts/fix-crons.js --dedup
输出格式
每个 check 脚本输出一份健康报告写入data/health-report.json：
{
"checkedAt": "",
"channels": {
"feishu": {
"status": "OK | EXPIRED | DISCONNECTED | NOT_CONFIGURED",
"detail": "..."
},
"telegram": {
"status": "OK | SILENT | TOKEN_INVALID | NOT_CONFIGURED",
"detail": "..."
},
"wechat": {
"status": "OK | BRIDGE_DOWN | NOT_CONFIGURED",
"detail": "..."
}
},
"crons": [
{
"id": "morning-push",
"schedule": "0 8 *",
"lastRun": "",
"status": "OK | MISSED | DUPLICATE | FAILED",
"duplicateCount": 0
}
],
"overallStatus": "HEALTHY | DEGRADED | CRITICAL",
"actionsNeeded": ["fix-feishu", "dedup-crons"]
}
常见问题速查
| 症状 | 根因 | 修复命令 |
|---|---|---|
| 飞书收不到推送 | lark-cli token 过期 | node scripts/fix-feishu.js |
| Telegram bot 无响应 | webhook 断开 / token 失效 | node scripts/check-telegram.js → 按提示操作 |
| 定时任务重复触发 | cron 条目重复注册 | node scripts/fix-crons.js --dedup |
| 定时任务静默不跑 | cron 进程崩溃 / 配置丢失 | node scripts/check-crons.js → 查看 MISSED 条目 |
| 配对码过期 | Telegram device code 超时 | node scripts/check-telegram.js --reauth |
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制