Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

钉钉日报自动提交

v1.0.0

钉钉日报自动提交工具 - 定时自动提交工作日报到钉钉日志系统。适用于每日工作汇报自动化、定时提交日报、钉钉日志集成等场景。支持Python导入和命令行两种方式使用,可自定义接收人列表和定时任务。

0· 247·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The name/description claim a Python script that submits DingTalk daily reports. However, the package contains only SKILL.md (no submit_log.py, no config.json, no today_work.txt, no tarball). The instructions assume local Python code and filesystem layout that do not exist in the bundle, which is internally inconsistent.
!
Instruction Scope
Runtime instructions tell the agent to import a Python module, run submit_log.py, read and clear today_work.txt, and rely on a config.json containing app_key/app_secret. They also reference a cron job schedule and methods to install files into the AI workspace. Those actions operate on local files, store credentials in plaintext, and would create persistent scheduled behavior — none of which is represented in the skill metadata or provided files.
!
Install Mechanism
The bundle has no install spec, but SKILL.md documents installing via extracting a tar.gz or moving a directory into the workspace. There is no tarball or provided code in the registry entry. The mismatch (documentation expecting an archive vs. no install content) is a red flag: the skill as provided cannot perform the described behavior without additional, external artifacts.
Credentials
The skill does not declare required environment variables but instructs the user to put sensitive credentials (app_key/app_secret and user IDs) into a local config.json. Requesting DingTalk credentials is proportionate to the described purpose, but storing secrets in a plaintext config file inside an AI workspace is risky and not enforced/validated by the skill metadata.
!
Persistence & Privilege
SKILL.md claims a cron job runs nightly at 22:30 and includes instructions that would create files and persistent scheduled behavior (installing into workspace, creating today_work.txt). The skill metadata does not request 'always' or other elevated privileges, but the instructions nonetheless describe creating persistent system-side state (cron), which has security implications and should be reviewed before use.
What to consider before installing
Do not install or run this skill as-is. The SKILL.md describes Python scripts, config files, and a tarball, but the package contains only the README — there is no code to inspect. Before proceeding request the actual source files (submit_log.py, config.json, the tar.gz) and a verifiable source/homepage. If you obtain the code, review it before running: check how app_key/app_secret are used and transmitted, prefer using environment variables or a secrets manager instead of plaintext config.json, and inspect any cron setup commands to avoid unintended persistent tasks. If you must test, run in an isolated environment (container/VM) and ensure network access is restricted until you've audited the script. If the skill's author or a trusted repo can't be provided, treat this package as incomplete and potentially risky.

Like a lobster shell, security has layers — review code before you run it.

automationvk9755x8xdt4vjaheg2mr2nje2s82rd73cronvk9755x8xdt4vjaheg2mr2nje2s82rd73daily-reportvk9755x8xdt4vjaheg2mr2nje2s82rd73dingtalkvk9755x8xdt4vjaheg2mr2nje2s82rd73latestvk9755x8xdt4vjaheg2mr2nje2s82rd73productivityvk9755x8xdt4vjaheg2mr2nje2s82rd73
247downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0

daily-dd-skills

钉钉日报自动提交 Skill

适用场景

  • 每日工作日志自动提交
  • 定时汇报工作进展
  • 钉钉日报自动化

核心功能

1. 自动提交日报

  • 每晚 22:30 自动提交当天工作日志
  • 自动发送给指定的接收人列表
  • 支持手动立即提交

2. 工作内容管理

  • 白天记录工作内容到 today_work.txt
  • 支持多条目记录
  • 自动清空已提交内容

3. 接收人配置

  • 支持多接收人配置
  • 自动发送给主管/同事
  • 接收范围可视化

使用方法

快速开始

from skills.daily_dd_skills.submit_log import submit_daily_report

# 立即提交日报
submit_daily_report(
    today_work="""1. 完成XX功能开发
2. 修复XXbug
3. 参加XX会议"""
)

命令行提交

# 方式1:直接提交内容
python3 skills/daily-dd-skills/submit_log.py "今日工作内容"

# 方式2:从文件读取(需要提前保存工作内容)
echo "今日工作内容" > skills/daily-dd-skills/today_work.txt
python3 skills/daily-dd-skills/submit_log.py

定时任务配置

已配置 cron 定时任务:

  • 时间: 每晚 22:30
  • 功能: 自动读取当天工作内容并提交
  • 接收人: 可自定义

配置说明

钉钉应用配置

编辑 config.json

{
  "dingtalk": {
    "app_key": "your-app-key",
    "app_secret": "your-app-secret",
    "user_id": "your-user-id",
    "template_id": "your-template-id"
  }
}

接收人配置

{
  "receivers": [
    {"name": "张三", "user_id": "user-id-1"},
    {"name": "李四", "user_id": "user-id-2"}
  ]
}

文件结构

daily-dd-skills/
├── SKILL.md           # 本说明文档
├── submit_log.py      # 主提交脚本
├── config.json        # 配置文件
└── today_work.txt     # 工作内容记录(自动生成)

工作流程

白天记录工作内容 → 保存到 today_work.txt
         ↓
晚上22:30自动提交 → 钉钉日志系统
         ↓
接收人收到日报 → 可查看详情

安装方法

方式1:直接解压

tar -xzf daily-dd-skills.tar.gz -C /目标AI/workspace/skills/

方式2:手动复制

mv daily-dd-skills/ /目标AI/workspace/skills/

依赖要求

  • Python 3.x
  • requests 库

注意事项

  1. AppKey/AppSecret: 需要替换为自己的钉钉应用凭证
  2. 接收人UserID: 需要根据实际情况修改
  3. 日志模板: 需先在钉钉后台配置好日报模板
  4. 网络要求: 需要能访问钉钉 API (oapi.dingtalk.com)

更新记录

  • 2026-03-12: 创建 daily-dd-skills,支持钉钉日报自动提交

Comments

Loading comments...