The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation mentions that the sender class automatically reads credentials from a local configuration file named openclaw.json. This is standard behavior for its intended integration with the Feishu API.\n- [COMMAND_EXECUTION]: Provides instructions to execute a shell command using python3 -c for converting SVG files to PNG format using the cairosvg library.\n- [DATA_EXFILTRATION]: Transmits user-provided text and local image files to the Feishu API. Feishu is a well-known enterprise communication service, and this data transmission is the primary intended function of the skill.\n- [SAFE]: The skill has a surface for indirect prompt injection (Category 8) as it ingests user-provided data (e.g., titles and markdown content) to be displayed in Feishu cards. Ingestion points: elements parameter in send_rich_card calls. Capability inventory: Data transmission to the Feishu API via the send_card.py script. Boundary markers and sanitization are not explicitly defined in the instructions, but the risk is assessed as safe given the intended display-only use case.

feishu-rich-card