Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

dingtalk mailbox

v1.0.0

钉钉邮箱访问skill,使用mcporter调用钉钉邮箱MCP服务。支持查询可用邮箱列表、搜索邮件(类KQL表达式)、获取邮件详情、发送邮件。适用于需要通过AI助手管理钉钉邮箱的场景,如查询邮件、自动回复、邮件归档等。

0· 98·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jackeylee007/dingtalk-mailbox.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "dingtalk mailbox" (jackeylee007/dingtalk-mailbox) from ClawHub.
Skill page: https://clawhub.ai/jackeylee007/dingtalk-mailbox
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dingtalk-mailbox

ClawHub CLI

Package manager switcher

npx clawhub@latest install dingtalk-mailbox
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The declared purpose (accessing DingTalk mailbox via MCP to list/search/get/send mail) matches the SKILL.md instructions which use mcporter and the MCP StreamableHttp URL. The core capabilities are coherent with the description.
!
Instruction Scope
The SKILL.md instructs the user/agent to run commands (npm install -g mcporter, mcporter config add, mcporter call ...) and to place the MCP 'url' token in a config file (~/.mcporter/mcporter.json). The skill thus expects filesystem writes and network access to the MCP URL and handling of a secret token. The metadata did not declare these config paths or token handling requirements.
!
Install Mechanism
There is no install spec in the registry, but the instructions require running `npm install -g mcporter` (a global npm install). That is an implicit install mechanism not captured in metadata; global npm installs can modify system state and require privileges. The mcporter package source is not verified in the manifest.
!
Credentials
No required environment variables or primary credential are declared, yet the skill requires the user to obtain and configure an MCP Token (the StreamableHttp URL) and save it to a config file. The metadata omits required config path and secret handling; this is an inconsistency and increases the chance of accidental secret exposure.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. However, the instructions encourage a global npm install (system-level change) and creation of a config file in the user's home directory — these have persistence implications that are not declared in the registry metadata.
What to consider before installing
This skill appears to do what it says (manage DingTalk mailbox via the MCP API), but the SKILL.md requires you to install an external tool (mcporter) globally and to store an MCP token (StreamableHttp URL) in ~/.mcporter/mcporter.json — none of those requirements are declared in the skill metadata. Before installing or running: 1) Verify the mcporter npm package source and its authenticity (check the npm page, GitHub repo, and maintainers). 2) Avoid doing a blind `npm install -g` as it modifies system state; consider installing in a container or virtual environment first. 3) Treat the MCP 'url' as a secret; understand where mcporter stores it and whether it is encrypted. 4) Ask the skill author to update the registry entry to declare required binaries (npm/node/mcporter), required config paths, and the need for a secret token. 5) If possible, test in an isolated account/environment and audit network calls made by mcporter. If you can't verify mcporter or the token handling, consider this skill suspicious and avoid providing production credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk974ec9vngf8850d2e8788wfnd83p2cz
98downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

钉钉邮箱 Skill

通过 mcporter 调用钉钉邮箱 MCP 服务,实现邮箱查询、邮件搜索、邮件查看和发送功能。

前置要求

  1. 安装 mcporter

    npm install -g mcporter
    
  2. 钉钉企业邮箱账号

配置步骤

1. 获取钉钉邮箱 MCP Token

  1. 登录钉钉企业邮箱网页版
  2. 进入 设置MCP服务
  3. 点击 生成Token
  4. 复制生成的 JSON配置 中的 url 字段值(StreamableHttp URL)

2. 添加 mcporter 配置

使用以下命令添加钉钉邮箱的 MCP Server:

mcporter config add dingtalk-mailbox --url "<StreamableHttp URL>" --config ~/.mcporter/mcporter.json

<StreamableHttp URL> 替换为从钉钉邮箱获取的实际 URL。

3. 验证配置

mcporter list

应该能看到 dingtalk-mailbox 服务器及其提供的工具列表。

可用功能

1. 查询可用邮箱列表 (list_user_mailboxes)

查询当前钉钉用户可以使用的邮箱地址列表。

参数:

示例:

mcporter call dingtalk-mailbox.list_user_mailboxes

返回示例:

{
  "emailAccounts": [
    {
      "orgName": "示例公司",
      "type": "ORG",
      "email": "user@example.com"
    }
  ],
  "success": "true"
}

2. 搜索邮件 (search_emails)

使用类似 KQL 的查询表达式搜索邮件。支持分页、排序和字段选择。

参数:

  • email (string, 必需): 搜索目标邮箱地址
  • query (string, 必需): KQL 查询表达式
  • size (string, 必需): 每次返回的最大结果数量(1-100)
  • cursor (string, 可选): 分页游标

示例:

# 搜索收件箱邮件
mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\"folderId:2\", size:\"5\")"

# 搜索未读邮件
mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\"isRead:false\", size:\"10\")"

# 搜索来自特定发件人的邮件
mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\"from:sender@example.com\", size:\"5\")"

支持的查询字段:

字段说明示例
date日期date>2025-01-01T00:00:00Z
folderId文件夹IDfolderId:2 (收件箱), folderId:1 (已发送)
isRead是否已读isRead:true, isRead:false
hasAttachments是否有附件hasAttachments:true
subject主题subject:\"紧急\"
from发件人from:\"alice\"
to收件人to:\"bob@example.com\"

文件夹ID对照:

  • 1 - 已发送
  • 2 - 收件箱
  • 3 - 垃圾邮件
  • 5 - 草稿
  • 6 - 已删除

3. 获取邮件详情 (get_email_by_message_id)

根据邮件ID获取完整的邮件内容,包括正文。

参数:

  • email (string, 必需): 邮件所属的邮箱地址
  • messageId (string, 必需): 邮件ID(通过搜索获得)

示例:

mcporter call "dingtalk-mailbox.get_email_by_message_id(email:\"user@example.com\", messageId:\"<邮件ID>\")"

4. 发送邮件 (send_email)

使用指定的邮箱地址作为发件人发送邮件。

参数:

  • from (string, 必需): 发信邮箱地址
  • toRecipients (string[], 必需): 收件人邮箱地址列表
  • subject (string, 必需): 邮件主题
  • body (string, 必需): Markdown 格式的邮件正文
  • ccRecipients (string[], 可选): 抄送人邮箱地址列表

示例:

# 发送简单邮件
mcporter call "dingtalk-mailbox.send_email(from:\"user@example.com\", toRecipients:[\"to@example.com\"], subject:\"会议通知\", body:\"明天下午开会\")"

# 发送带抄送的邮件
mcporter call "dingtalk-mailbox.send_email(from:\"user@example.com\", toRecipients:[\"to@example.com\"], ccRecipients:[\"cc@example.com\"], subject:\"会议通知\", body:\"## 会议通知\n\n明天下午2点在301会议室开会。\")"

常见使用场景

1. 查看今天的邮件

mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\"date>2025-03-27T00:00:00Z AND folderId:2\", size:\"20\")"

2. 查找未读邮件

mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\"isRead:false AND folderId:2\", size:\"10\")"

3. 查找特定主题的邮件

mcporter call "dingtalk-mailbox.search_emails(email:\"user@example.com\", query:\\\"subject:\\\"项目通知\\\"\\\", size:\\\"10\\\")"

4. 批量发送邮件

mcporter call "dingtalk-mailbox.send_email(from:\"user@example.com\", toRecipients:[\"a@example.com\", \"b@example.com\"], subject:\"通知\", body:\"各位同事:\n\n请注意查收附件。\n\n谢谢!\")"

常见问题

无法连接到 MCP 服务器

请确认:

  1. Token 是否有效
  2. URL 是否正确复制
  3. 网络连接是否正常

查看完整工具 schema

mcporter list dingtalk-mailbox --schema

测试结果

功能状态说明
list_user_mailboxes✅ 已测试成功获取邮箱列表
search_emails✅ 已测试成功搜索收件箱邮件
get_email_by_message_id✅ 已测试成功获取邮件详情
send_email✅ 已测试成功发送测试邮件

参考资料

License

MIT

Comments

Loading comments...