Harden credential file permissions across all auto-collectors #112

Problem

All *_auto_collector.py tools write credential configs (API tokens, passwords) to ~/.colleague-skill/*_config.json using Path.write_text(...), which respects the user's umask — on most systems that ends up as 0644 (world-readable within the user account's processes).

This means any process running as the same user can read tokens in plaintext.

Affected files

• tools/feishu_auto_collector.py — save_config() around line 72
• tools/slack_auto_collector.py — save_config() around line 102
• tools/dingtalk_auto_collector.py
• tools/confluence_auto_collector.py (pending PR feat: add Confluence auto-collector as new data source #106) — save_config() around line 89

Proposed fix

In each collector's save_config(), after writing the file:

import os
CONFIG_PATH.write_text(json.dumps(config, indent=2, ensure_ascii=False))
os.chmod(CONFIG_PATH, 0o600)

Also ensure the parent directory is created with restrictive perms:

CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True, mode=0o700)

Why good-first-issue

Small, mechanical change across 3-4 files. Well-scoped. Touches every collector so a great way to learn the codebase structure.

Acceptance criteria

• All existing collectors set 0o600 on the config file after write
• Parent directory is 0o700
• A unit test that creates a config and asserts the mode is correct (Unix-only; skip on Windows)
• Document the permission expectation in CONTRIBUTING.md under the Security section