多机器人去重消息

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: multi-bot-dedup Version: 1.0.0 The skill bundle provides behavioral instructions for an AI agent to implement a deduplication mechanism for multiple Feishu (Lark) bots. It uses a local state file (dedup_state.json) to track message hashes and timestamps, ensuring the agent only responds once to identical messages within a 30-second window. No malicious code, data exfiltration, or harmful prompt injections were identified.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A duplicate Feishu message from the same sender within the time window may receive no response, which is intended but could surprise users if the state is stale or the message is misclassified.

Why it was flagged

The skill explicitly instructs the agent to skip responding under defined deduplication conditions. This changes response behavior, but it is the disclosed purpose of the skill and is narrowly scoped.

Skill content
三条全满足 → **NO_REPLY(跳过)**
否则 → **正常回复,并更新 dedup_state.json**
Recommendation

Install only if you want this deduplication behavior, and clear or inspect dedup_state.json if expected replies are being skipped.

What this means

The local state file may retain sender IDs, timestamps, and hashes of recent message prefixes; if incorrect or tampered with, it could affect whether the agent replies.

Why it was flagged

The skill stores persistent per-sender deduplication state and reuses it to decide future reply behavior. The stored data is limited and purpose-aligned, but it is still persistent context.

Skill content
位置:`skills/multi-bot-dedup/dedup_state.json` ... `sender_id` ... `last_reply_time` ... `last_message_hash`
Recommendation

Keep the state file scoped to this skill, avoid sharing it unnecessarily, and periodically reset it if deduplication behavior becomes inaccurate.