channel-manager
Configure IM platform channels (Feishu, WeCom, Weixin, Discord, Telegram, DingTalk, QQ) for openclacky. Uses browser automation for navigation; guides the user to paste credentials and perform UI steps. Trigger on: "channel setup", "setup feishu", "setup wecom", "setup weixin", "setup wechat", "setup discord", "setup telegram", "setup dingtalk", "setup qq", "channel config", "channel status", "channel enable", "channel disable", "channel reconfigure", "channel doctor", "send message to weixin", "send message to feishu", "send message to wecom", "send message to discord", "send message to telegram", "send message to dingtalk", "send message to qq". Subcommands: setup, status, enable <platform>, disable <platform>, reconfigure, doctor, send.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill prompt instructs the LLM to read secret values (such as API keys and tokens) from files or environment variables and pass them as command-line arguments to curl commands (e.g., `-d '{"app_id":"<APP_ID>","app_secret":"<APP_SECRET>"}'`) and validation scripts, exposing secrets verbatim in commands and potentially in logs/output context.
- Repository
clacky-ai/openclacky
- Revision
e7b898f
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.