Use getpass for secret prompts in auto-collectors

CONTRIBUTING.md

@@ -91,6 +91,7 @@ Don't hit live APIs in CI. Mock with `unittest.mock` or the `responses` library.
 
 - **Never commit secrets, tokens, or personal data.** If you accidentally do, rotate the credential immediately and let a maintainer know.
 - Config files that hold credentials should be written to the user's home (e.g. `~/.colleague-skill/`) with permission `0600`.
+- **Always use `getpass.getpass()` for secret prompts** (API tokens, passwords, app secrets). Plain `input()` echoes characters to the terminal and leaves them in shell scrollback and session recordings. Public identifiers like App ID / username / URL can stay as `input()`.
 - If you find a security issue, **do not open a public issue.** Email the maintainer or DM on Discord.
 
 ---

tools/dingtalk_auto_collector.py

@@ -31,6 +31,7 @@
 import time
 import argparse
 import platform
+from getpass import getpass
 from pathlib import Path
 from datetime import datetime, timezone
 from typing import Optional
@@ -79,7 +80,7 @@ def setup_config() -> None:
     print()
 
     app_key = input("AppKey (ding_xxx): ").strip()
-    app_secret = input("AppSecret: ").strip()
+    app_secret = getpass("AppSecret: ").strip()
 
     config = {"app_key": app_key, "app_secret": app_secret}
     save_config(config)

tools/feishu_auto_collector.py

@@ -45,6 +45,7 @@
 import sys
 import time
 import argparse
+from getpass import getpass
 from pathlib import Path
 from datetime import datetime, timezone
 from typing import Optional
@@ -107,12 +108,12 @@ def setup_config() -> None:
     print()
 
     app_id = input("App ID (cli_xxx): ").strip()
-    app_secret = input("App Secret: ").strip()
+    app_secret = getpass("App Secret: ").strip()
 
     config = {"app_id": app_id, "app_secret": app_secret}
 
     print("\n是否配置 user_access_token？（用于私聊消息采集，可跳过）")
-    user_token = input("user_access_token (留空跳过): ").strip()
+    user_token = getpass("user_access_token (留空跳过): ").strip()
     if user_token:
         config["user_access_token"] = user_token
     p2p_chat_id = input("私聊 chat_id (留空跳过): ").strip()

tools/feishu_mcp_client.py

@@ -38,6 +38,7 @@
 import json
 import argparse
 import subprocess
+from getpass import getpass
 from pathlib import Path
 from typing import Optional
 
@@ -64,7 +65,7 @@ def setup_config() -> None:
     print("请前往飞书开放平台（open.feishu.cn）创建企业自建应用，获取以下信息：\n")
 
     app_id = input("App ID (cli_xxx): ").strip()
-    app_secret = input("App Secret: ").strip()
+    app_secret = getpass("App Secret: ").strip()
 
     print("\n配置方式选择：")
     print("  [1] App Token（应用权限，需要在飞书后台开通对应权限）")
@@ -79,7 +80,7 @@ def setup_config() -> None:
 
     if mode == "2":
         print("\n获取 User Token：飞书开放平台 → OAuth 2.0 → 获取 user_access_token")
-        user_token = input("User Access Token (u-xxx)：").strip()
+        user_token = getpass("User Access Token (u-xxx)：").strip()
         config["user_token"] = user_token
         print("注意：User Token 有效期约 2 小时，过期后需要重新配置")
 

tools/slack_auto_collector.py

@@ -36,6 +36,7 @@
 import sys
 import time
 import argparse
+from getpass import getpass
 from pathlib import Path
 from datetime import datetime, timezone
 from typing import Optional
@@ -128,7 +129,7 @@ def setup_config() -> None:
     print("步骤 3：Install to Workspace → 复制 Bot User OAuth Token（xoxb-...）")
     print("步骤 4：将 Bot 加入目标频道（/invite @your-bot-name）\n")
 
-    token = input("Bot User OAuth Token (xoxb-...): ").strip()
+    token = getpass("Bot User OAuth Token (xoxb-...): ").strip()
     if not token.startswith("xoxb-"):
         print("警告：Token 格式不对，应以 xoxb- 开头", file=sys.stderr)