The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/create_feishu_doc.py uses subprocess.run to invoke an external Python script (md_parser.py) located in a separate skill directory (~/.agents/skills/feishu-doc-orchestrator/).
[CREDENTIALS_UNSAFE]: The skill is designed to read sensitive local configuration files, specifically ~/.openclaw/.env and ~/.claude/feishu-config.env, to retrieve Feishu API authentication credentials (FEISHU_APP_ID, FEISHU_APP_SECRET).
[DATA_EXFILTRATION]: The skill retrieves local credentials and transmits data to a configurable API domain. Additionally, a hardcoded absolute file path in scripts/generate.py (/Users/delta/.openclaw/workspace) exposes internal system information, including a local username and directory structure.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its news gathering workflow.
Ingestion points: External news content gathered via web_search and web_fetch tools.
Boundary markers: None identified in the report formatting templates to delimit untrusted news content.
Capability inventory: Shell command execution via subprocess.run in scripts/create_feishu_doc.py, local file system writes in scripts/generate.py, and authenticated network requests in scripts/create_feishu_doc.py.
Sanitization: The clean_cell_content function in scripts/create_feishu_doc.py removes zero-width characters and Byte Order Marks from processed text.

daily-report