Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

DingTalk Integration

v0.1.0

DingTalk (钉钉) integration - Send messages, create groups, and automate DingTalk workflows

0· 116·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lukaizj/lukaizj-dingtalk.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "DingTalk Integration" (lukaizj/lukaizj-dingtalk) from ClawHub.
Skill page: https://clawhub.ai/lukaizj/lukaizj-dingtalk
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: DINGTALK_APP_ID, DINGTALK_APP_SECRET
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install lukaizj-dingtalk

ClawHub CLI

Package manager switcher

npx clawhub@latest install lukaizj-dingtalk
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Name, description, and code align with a DingTalk integration: sending messages, creating chats, and obtaining tokens. Requested env vars (app id/secret/agent id) are appropriate for this purpose. However, metadata and documentation disagree on whether DINGTALK_AGENT_ID is required, and the code reads that variable optionally — this mismatch should be resolved.
Instruction Scope
SKILL.md and instructions.md limit actions to DingTalk API calls (send messages, create/list chats, get token). The runtime instructions and code only reference DingTalk endpoints (oapi.dingtalk.com) and environment variables associated with DingTalk. There are no instructions to read unrelated files, contact unexpected endpoints, or exfiltrate arbitrary data.
Install Mechanism
There is no install spec (instruction-only), so nothing is fetched or written automatically — lower install risk. The package includes a Python module that uses the 'requests' library; however, no dependency declaration or install step is provided, so the runtime may fail if 'requests' is not present.
!
Credentials
The skill requests DINGTALK_APP_ID and DINGTALK_APP_SECRET (expected). Documentation also marks DINGTALK_AGENT_ID as required in SKILL.md table, but claw.json marks it optional and the code will work with an empty agent id (prints a warning). This inconsistency could lead to confusion about which secrets are needed. No unrelated credentials are requested.
Persistence & Privilege
The skill does not request 'always: true', does not modify other skills, and does not require config paths or system-level privileges. It runs network calls to the DingTalk API as expected.
What to consider before installing
This skill looks like a real DingTalk integration, but review a few items before installing: - Confirm the source and code: the repo homepage is provided; inspect the repository (dingtalk.py) yourself to ensure it matches your expectations. - Resolve env var mismatch: SKILL.md marks DINGTALK_AGENT_ID as required but the registry (claw.json) marks it optional and the code treats it as optional. Decide whether the agent id is needed and only provide the minimum credentials. - Ensure 'requests' is available in the runtime environment (the code depends on it but there is no declared dependency or install step). - Limit App permissions: create a DingTalk app with the least privileges needed (message-sending scopes only) and rotate/separate credentials used for the skill. - Test safely: run the Python module in a controlled environment to confirm behavior (what endpoints are called, how tokens are handled). Note the skill will perform network calls to oapi.dingtalk.com using your App ID/Secret. If you require stronger assurance, ask the author to: (1) make DINGTALK_AGENT_ID handling consistent across README/manifest/code, (2) add explicit dependency declarations (requests) or an install spec, and (3) provide a short security note about token handling and necessary app permissions.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

EnvDINGTALK_APP_ID, DINGTALK_APP_SECRET
latestvk97d71dtf6wqwnmk9p5qqek381857sq3
116downloads
0stars
1versions
Updated 1w ago
v0.1.0
MIT-0

DingTalk Integration (钉钉集成)

DingTalk (钉钉) integration skill for OpenClaw. Send messages, manage groups, and automate workflows with DingTalk.

Capabilities

  • Send text messages to chats
  • Send rich interactive cards
  • Create new chat groups
  • List chat members
  • Send webhook notifications
  • Handle incoming callbacks

Setup

  1. Create a DingTalk mini app at https://open.dingtalk.com/
  2. Get App ID and App Secret from the application settings
  3. Add required permissions
  4. Configure environment variables

Environment Variables

VariableRequiredDescription
DINGTALK_APP_IDYesYour DingTalk App ID
DINGTALK_APP_SECRETYesYour DingTalk App Secret
DINGTALK_AGENT_IDYesYour DingTalk Agent ID

Usage

Send a message

Send a message "Hello from OpenClaw" to user user123
Send a card message to chat chat_id_456

Create a group

Create a new DingTalk group named "Project Alpha"
Add user "zhangsan" to group "Project Alpha"

List chats

List my DingTalk chats
Show recent chat messages

Message Types

This skill supports:

  • Text: Plain text messages
  • Markdown: Markdown formatted messages
  • Interactive: Cards with buttons, inputs, and actions

Troubleshooting

  • Ensure your app is published in the DingTalk admin console
  • Check that all required permissions are granted
  • Verify the App ID and Secret are correct
  • Make sure the app is added to required chats

Comments

Loading comments...