onebot QQ群管理

QQ 群管理操作，通过 OneBot 11 API 实现群名修改、群公告、禁言、踢人、设置管理员、全员禁言等功能。当用户需要在 QQ 群中执行管理操作时使用，如修改群名、发公告、禁言某人、踢人、设置管理员等。

Security Scan

The skill's code and instructions largely match its stated purpose (managing QQ groups via OneBot), but it contains a few unexpected or risky choices (hardcoded token, ability to read arbitrary local files, and an odd NODE_PATH) that merit caution before installing or using it.

Purpose & Capability

Name and description match the implementation: the script sends OneBot actions over a WebSocket to perform group operations (rename, notices, ban, kick, set admin, upload portrait, etc.). No unrelated services or credentials are requested.

Instruction Scope

The script supports a special syntax key=@/path/to/file which reads arbitrary local files and inserts their contents into parameters. While useful for uploading images, it also allows exfiltration of any local file if misused. SKILL.md documents local file paths for the 'file' parameter, but does not explicitly warn about the broader risk of reading arbitrary system files.

Install Mechanism

Instruction-only skill with a single JS helper file and no install spec. Nothing is downloaded or executed from remote URLs by an installer.

Credentials

The script honors ONEBOT_WS_URL and ONEBOT_WS_TOKEN (documented in SKILL.md) which is appropriate. However, the code contains a hardcoded default token ('FTubmd6pc77aX~XK'), which is unexpected and poor practice: embedding credentials in code can be accidental or misleading. The script also mutates module resolution by pushing a root NODE_PATH, which is unusual and may cause it to load unexpected modules from that path.

Persistence & Privilege

always is false, no install steps, and the skill does not modify other skill or system-wide configurations. It runs only when invoked.

What to consider before installing

This skill appears to do what it says (manage QQ groups via a OneBot WebSocket), but review and consider the following before use: - The helper script can read any local file when you pass a parameter like key=@/path/to/file. That is necessary for uploading portrait files, but it also means a malicious or mistaken invocation could read sensitive files and send their contents over the WebSocket. Only run the script in a trusted environment and avoid passing paths to sensitive files. - The code contains a hardcoded default token (ONEBOT_WS_TOKEN) and a nonstandard NODE_PATH. Treat the embedded token as suspicious: confirm whether it is intended, remove or replace it, and set your own token via ONEBOT_WS_TOKEN. Consider asking the publisher why the token is hardcoded. - Verify the ONEBOT_WS_URL you use. The default is localhost (ws://127.0.0.1:13001), which is safer; do not point the skill at an untrusted remote WebSocket endpoint unless you understand the implications. - If you do not trust the source (homepage unknown), consider running the script in a sandbox or reviewing/modifying the code (e.g., restrict file-read behavior to image paths only and remove the hardcoded token) before enabling the skill.

OneBot 群管理

通过 scripts/onebot-action.js 调用 napcat 的 OneBot 11 API 执行群管理操作。

脚本路径

~/.openclaw/workspace/skills/onebot-group-admin/scripts/onebot-action.js

用法

node <脚本路径> <action> [key=value ...]

参数中的数字会自动转为整数，字符串不需要引号。含空格的值用双引号包裹。

常用操作

修改群名

node onebot-action.js set_group_name group_id=<群号> group_name="新群名"

发送群公告

node onebot-action.js _send_group_notice group_id=<群号> content="公告内容"

⚠️ 注意是 _send_group_notice（带下划线前缀），这是 napcat 扩展 API，标准 send_group_notice 不可用。

禁言成员（单位：秒，0为解除）

node onebot-action.js set_group_ban group_id=<群号> user_id=<QQ号> duration=600

• duration=0 解除禁言
• duration=3600 禁言1小时
• duration=86400 禁言1天
• duration=2592000 禁言30天

全员禁言

# 开启全员禁言
node onebot-action.js set_group_whole_ban group_id=<群号> enable=1
# 关闭全员禁言
node onebot-action.js set_group_whole_ban group_id=<群号> enable=0

踢出成员

node onebot-action.js set_group_kick group_id=<群号> user_id=<QQ号> reject_add_request=0

• reject_add_request=1 拒绝再次加群

设置/取消群管理员

# 设置管理员
node onebot-action.js set_group_admin group_id=<群号> user_id=<QQ号> enable=1
# 取消管理员
node onebot-action.js set_group_admin group_id=<群号> user_id=<QQ号> enable=0

设置群成员名片

node onebot-action.js set_group_card group_id=<群号> user_id=<QQ号> card="新名片"

设置群成员头衔

node onebot-action.js set_group_special_title group_id=<群号> user_id=<QQ号> title="头衔" duration=-1

设置群头像

node onebot-action.js set_group_portrait group_id=<群号> file="<图片路径>"

⚠️ API 名称是 set_group_portrait（go-cqhttp 扩展 API），不是 OneBot 11 标准的 set_group_avatar。Bot 需要管理员权限。

• file 支持本地路径（如 /tmp/openclaw-onebot/xxx.png）、file:// 协议、base64:// 协议、HTTP URL

撤回消息

node onebot-action.js delete_msg message_id=<消息ID>

获取群信息

node onebot-action.js get_group_info group_id=<群号>

获取群成员列表

node onebot-action.js get_group_member_list group_id=<群号>

获取群成员信息

node onebot-action.js get_group_member_info group_id=<群号> user_id=<QQ号>

注意事项

• 群号 > 100000000 时 OneBot 插件可能误判为用户 ID，脚本直接传数字即可
• Bot 需要对应的管理员权限才能执行这些操作
• 敏感操作（踢人、禁言）执行前应先确认
• 默认连接 ws://127.0.0.1:13001，可通过环境变量 ONEBOT_WS_URL 和 ONEBOT_WS_TOKEN 覆盖