📦 yuqing-bitable-and-label — 飞书多维表同步
v2.0.8增量同步小愛 API 数据至飞书多维表，并可选自动为记录打类型与情感标签，实现舆情数据云端结构化与智能标注。
1· 305·0 当前·0 累计
by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to implement the claimed sync-and-label workflow and requires Feishu app credentials and a XiaoAi token — those are expected. Things to consider before installing:
- Do NOT set OPENAI_API_KEY / OPENAI_BASE_URL / OPENAI_MODEL unless you trust the external LLM gateway: if provided the skill will send record content to that gateway (default base is api.openai.com), but the SKILL.md did not declare network permissions for that. That mismatch can result in unexpected outbound data ...详细分析 ▾
ℹ 用途与能力
The declared inputs (Feishu APP_ID/APP_SECRET, XiaoAi token, bitable_url) match the stated purpose of syncing data to a Feishu Bitable and writing labels. The code implements expected behaviors (fetch from XiaoAi API, write to Feishu bitable, optional labeling). Note: the labeling component optionally uses an OpenAI-compatible gateway if OPENAI_* env vars are provided; that capability is plausible for the stated labeling purpose but is not listed in SKILL.md inputs or permissions.
⚠ 指令范围
The SKILL.md entrypoint runs sync_and_label_skill.py which follows the declared purpose. However the labeling runtime can (if OPENAI_API_KEY / OPENAI_BASE_URL / OPENAI_MODEL are set) send record content to an arbitrary OpenAI-compatible endpoint. SKILL.md's network permissions only list Feishu and the default XiaoAi host, so outbound calls to api.openai.com or other gateways are not declared. Additionally auxiliary scripts (sync.sh, monitor.sh) read/write .env, .cache, logs, and may modify files in the skill directory (e.g., sed edits of .env), which expands the runtime scope beyond a simple one-shot sync.
✓ 安装机制
There is no install spec (instruction-only for platform), and provided files are Python scripts and shell helpers that run in-place. No remote download/install from arbitrary URLs is present, which is lower risk. The package includes several helper scripts and caches but nothing that auto-fetches executable code at install time.
⚠ 凭证需求
Required secrets (Feishu APP_ID/APP_SECRET, XiaoAi token) are proportional to the sync/write-to-bitable functionality. However the code will also use optional environment variables OPENAI_API_KEY / OPENAI_BASE_URL / OPENAI_MODEL (and other LLM config) to call external LLM gateways. Those are not declared in the skill inputs or network permissions; if set they enable sending user content to arbitrary endpoints. The shell helpers source a .env file from the skill directory (not system-wide) but will mutate it via auto-fix logic — review before use.
✓ 持久化与权限
The skill is not always-enabled and does not request elevated platform privileges. It creates local files (.cache, logs, .sync.lock) and may modify files inside its own skill directory (e.g., .env auto-fix), but it does not modify other skills or request system-wide persistent privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv2.0.82026/3/16
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install yuqing-bitable-and-label
镜像加速npx clawhub@latest install yuqing-bitable-and-label --registry https://cn.longxiaskill.com镜像同步中