Dingtalk Ai Table Only Curl

钉钉 AI 表格（多维表格）操作。当用户提到"钉钉AI表格"、"AI表格"、"多维表格"、"工作表"、"字段"、"记录"、"新增记录"、"查询记录"、"更新记录"、"删除记录"、"新建字段"、"删除字段"、"dingtalk AI table"、"dingtalk notable"、"able文件"时使用此技能。...

Security Scan

The skill's code and instructions are coherent with its stated purpose (DingTalk Notable / AI table operations) but it stores and caches sensitive DingTalk credentials locally and the registry metadata omits those required config items — review the helper script and storage behavior before installing.

Purpose & Capability

The SKILL.md, references/api.md and scripts/dt_helper.sh all implement DingTalk Notable (AI 表格) API calls and require DingTalk application credentials and user identifiers; that is consistent with the skill name and description. However, the registry metadata declares no required env vars/credentials while the runtime instructions clearly require DINGTALK_APP_KEY, DINGTALK_APP_SECRET, DINGTALK_MY_USER_ID, DINGTALK_MY_OPERATOR_ID and DINGTALK_AI_TABLE_BASE_ID — a discrepancy that should be corrected.

Instruction Scope

The SKILL.md confines actions to obtaining tokens, converting userId↔unionId, and calling api.dingtalk.com / oapi.dingtalk.com endpoints. It instructs the agent to read/write a local config (~/.dingtalk-skills/config) via the included dt_helper.sh, to write multi-line commands to /tmp/<task>.sh and execute them. Those behaviors are explainable for this integration but mean credentials and tokens are written to disk and temporary scripts are executed — important operational details for users to accept consciously.

Install Mechanism

No install spec or external downloads. This is an instruction-only skill with an included shell helper script; nothing is fetched from third-party URLs during installation.

Credentials

The credentials requested by the skill (app key/secret, userId/unionId, base_id) are appropriate for accessing DingTalk Notable APIs. However, the registry did not declare these required credentials at installation metadata level. The helper script stores app secret and tokens in plaintext under ~/.dingtalk-skills/config (or a path overridden by DINGTALK_CONFIG), which is typical for CLI helpers but increases local persistence risk and should be considered by the user.

Persistence & Privilege

always:false (normal). The skill writes and updates its own config file in the user's home directory and caches tokens there; it does not attempt to modify other skills or system-wide settings. The ability to run commands by creating /tmp scripts means it executes user-authorized actions on the machine at runtime — expected for a CLI-based helper but worth noting.

Assessment

This skill legitimately operates DingTalk AI tables and therefore needs your DingTalk AppKey/AppSecret and user identifiers. Before installing: (1) Review scripts/dt_helper.sh — it will create ~/.dingtalk-skills/config (or use $DINGTALK_CONFIG) and store your AppSecret and cached tokens in plaintext. (2) Understand the skill will create and execute temporary shell scripts in /tmp to run multi-line commands. (3) Use a least-privilege DingTalk application (only grant Document.Notable.Read/Write), and consider using short-lived or revocable credentials you can rotate. (4) If you are uncomfortable with plaintext storage, set DINGTALK_CONFIG to a controlled path or avoid installing; revoke the app secret or clear cached tokens after use. (5) Note the registry metadata omits required credentials — verify the skill's documentation and fix metadata before automated deployment.

钉钉 AI 表格技能

负责钉钉 AI 表格（.able 格式多维表格）的所有操作。本文件为策略指南，仅包含决策逻辑和工作流程。完整 API 请求格式见文末「references/api.md 查阅索引」。

核心概念

• AI 表格（.able 文件）：多维表格，使用 Notable API（/v1.0/notable），不是普通电子表格
• base_id：AI 表格文件的 nodeId，从分享链接 https://alidocs.dingtalk.com/i/nodes/<base_id> 提取
• 工作表（Sheet）：表格内的单张表，包含字段和记录
• 字段（Field）：列定义，有名称和类型（text、number、date）
• 记录（Record）：数据行，fields 中用字段名称（非 ID）作键
• operatorId：所有接口必须的 unionId 参数，通过 dt_helper.sh --to-unionid 自动转换

工作流程（每次执行前）

1. 先识别本次任务类型 → 例如：列工作表、创建字段、查询记录、更新记录、删除记录
2. 按本次任务校验所需配置 → 通过 bash scripts/dt_helper.sh --get KEY 读取；仅校验本任务必须项
3. 仅收集缺失配置 → 若缺少某项，一次性询问用户所有缺失值，用 bash scripts/dt_helper.sh --set KEY=VALUE 写入
4. 获取 Token / operatorId → 直接调用 bash scripts/dt_helper.sh，token 获取与缓存细节无需关心
5. 执行操作 → 凡是包含变量替换、管道或多行逻辑的命令，写入 /tmp/<task>.sh 再 bash /tmp/<task>.sh 执行。不要把多行命令直接粘到终端里（终端工具会截断），也不要用 <<'EOF' 语法（heredoc 在工具中同样会被截断导致变量丢失）

按任务校验配置（必须先做）

• 所有任务通用必需：DINGTALK_APP_KEY、DINGTALK_APP_SECRET、DINGTALK_MY_USER_ID
• 涉及任何 AI 表格 API 调用：必须有 DINGTALK_MY_OPERATOR_ID（若缺失，先用 bash scripts/dt_helper.sh --to-unionid 自动转换并写回）
• 工作表/字段/记录相关操作：必须有 DINGTALK_AI_TABLE_BASE_ID（若缺失，要求用户提供 AI 表格链接并提取 /nodes/<base_id>）

规则：未通过“本次任务配置校验”前，不得进入 API 调用步骤。

凭证禁止在输出中完整打印，确认时仅显示前 4 位 + ****

所需配置

配置键	必填	说明	如何获取
DINGTALK_APP_KEY	✅	应用 AppKey	钉钉开放平台 → 应用管理 → 凭证信息
DINGTALK_APP_SECRET	✅	应用 AppSecret	同上
DINGTALK_MY_USER_ID	✅	当前用户的企业员工 ID（userId）	管理后台 → 通讯录 → 成员管理 → 点击姓名查看
DINGTALK_MY_OPERATOR_ID	✅	当前用户的 unionId（operatorId）	首次由 bash scripts/dt_helper.sh --to-unionid 自动转换并写入
DINGTALK_AI_TABLE_BASE_ID	✅	AI 表格的 nodeId	从 AI 表格分享链接 /nodes/<id> 提取

身份标识说明

标识	说明
userId（= staffId）	企业内部员工 ID，可通过管理后台 -> 通讯录 -> 成员管理 -> 点击姓名查看
unionId	跨企业/跨应用唯一标识，可通过 bash scripts/dt_helper.sh --to-unionid <userid> 获取

执行脚本模板

#!/bin/bash
set -e
HELPER="./scripts/dt_helper.sh"
NEW_TOKEN=$(bash "$HELPER" --token)
OPERATOR_ID=$(bash "$HELPER" --get DINGTALK_MY_OPERATOR_ID)
BASE_ID=$(bash "$HELPER" --get DINGTALK_AI_TABLE_BASE_ID)

# 在此追加具体 API 调用，例如列出工作表：
SHEETS=$(curl -s -X GET "https://api.dingtalk.com/v1.0/notable/bases/${BASE_ID}/sheets?operatorId=${OPERATOR_ID}" \
  -H "x-acs-dingtalk-access-token: $NEW_TOKEN")
echo "工作表列表: $SHEETS"

Token 失效处理：dt_helper 仅按时间缓存，无法感知 token 被提前吊销。若 API 返回 401（token 无效/过期），用 --nocache 跳过缓存强制重新获取：

NEW_TOKEN=$(bash "$HELPER" --token --nocache)

references/api.md 查阅索引

确定好要做什么之后，用以下命令从 references/api.md 中提取对应章节的完整 API 细节（请求格式、参数说明、返回值示例）：

grep -A 20 "^## 1. 列出工作表" references/api.md
grep -A 15 "^## 2. 查询单个工作表" references/api.md
grep -A 30 "^## 3. 创建工作表" references/api.md
grep -A 15 "^## 4. 删除工作表" references/api.md
grep -A 25 "^## 5. 列出字段" references/api.md
grep -A 28 "^## 6. 创建字段" references/api.md
grep -A 15 "^## 7. 更新字段" references/api.md
grep -A 15 "^## 8. 删除字段" references/api.md
grep -A 25 "^## 9. 新增记录" references/api.md
grep -A 40 "^## 10. 查询记录列表" references/api.md
grep -A 18 "^## 11. 更新记录" references/api.md
grep -A 15 "^## 12. 删除记录" references/api.md
grep -A 10 "^## 错误码" references/api.md
grep -A 6  "^## 所需应用权限" references/api.md