Dingtalk Ai Table
v0.6.0钉钉 AI 表格（多维表）操作技能。使用 mcporter CLI 连接钉钉官方新版 AI 表格 MCP server，基于 baseId / tableId / fieldId / recordId 体系执行 Base、Table、Field、Record 的查询与增删改。适用于创建 AI 表格、搜索表格、读取...
⭐ 10· 3.4k·35 current·37 all-time
byMarila Wang@aliramw
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, required binaries (mcporter, python3), required env vars (DINGTALK_MCP_URL, OPENCLAW_WORKSPACE), and included scripts all match a tool for operating the DingTalk AI Table MCP server. There are no unrelated credentials or binaries requested.
Instruction Scope
Runtime instructions call mcporter and Python scripts, inspect MCP schema, and read/write files under the declared OPENCLAW_WORKSPACE. The one-time schema check writes a small cache file into the workspace; this is consistent with the stated 'workspace sandbox' model. Minor documentation inconsistency: examples sometimes pass the raw URL to mcporter and sometimes refer to the registered name; this is a usability/documentation issue, not a security mismatch.
Install Mechanism
No install spec is provided (instruction-only plus utility scripts). Dependencies are standard (npm-installed mcporter or system mcporter CLI); there are no remote downloads or obscure installers in the package.
Credentials
The skill only requests DINGTALK_MCP_URL (the MCP server Streamable HTTP URL containing an access token) and OPENCLAW_WORKSPACE. Both are justified by the described functionality. Minor point: the schema-check script computes an md5 of the full URL and uses it for a cache filename — this stores a derivative of the credential in a workspace path (md5 is one-way but unsalted), so choose a dedicated workspace directory and protect it.
Persistence & Privilege
always is false and the skill does not request elevated/global persistent privileges. It writes small cache files and reads/writes user files only under OPENCLAW_WORKSPACE (or current directory if unset); that behavior is declared in SKILL.md and present in scripts.
Assessment
This skill appears to do what it says: it uses mcporter and Python scripts to operate DingTalk AI tables and requires the MCP Streamable HTTP URL (DINGTALK_MCP_URL) plus a local workspace root for file I/O. Before installing: (1) review and protect the DINGTALK_MCP_URL (it includes an access token) and prefer storing it in mcporter config rather than exposing it broadly; (2) set OPENCLAW_WORKSPACE to a dedicated directory you control (the skill will create a .cache/ entry and write a schema-check file whose filename is derived from an MD5 of the URL); (3) inspect the included scripts if you need extra assurance (they call mcporter and perform JSON parsing, but contain explicit input validation and path sandboxing); (4) ensure mcporter is the official CLI and keep it up-to-date. If you need stricter limits, run the scripts in a confined/test environment first.Like a lobster shell, security has layers — review code before you run it.
ai-tablevk97686b34z1b83vzjnpkw5xmqx83yk3ndingtalkvk97686b34z1b83vzjnpkw5xmqx83yk3nlatestvk97686b34z1b83vzjnpkw5xmqx83yk3nmcpvk97686b34z1b83vzjnpkw5xmqx83yk3nopenclawvk97686b34z1b83vzjnpkw5xmqx83yk3nskillvk97686b34z1b83vzjnpkw5xmqx83yk3n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsmcporter, python3
EnvDINGTALK_MCP_URL, OPENCLAW_WORKSPACE
Primary envDINGTALK_MCP_URL