by 安全扫描
OpenClaw
安全
medium confidenceThe skill's code and instructions are coherent with its stated purpose (DingTalk Notable / AI table operations) but it stores and caches sensitive DingTalk credentials locally and the registry metadata omits those required config items — review the helper script and storage behavior before installing.
评估建议
This skill legitimately operates DingTalk AI tables and therefore needs your DingTalk AppKey/AppSecret and user identifiers. Before installing: (1) Review scripts/dt_helper.sh — it will create ~/.dingtalk-skills/config (or use $DINGTALK_CONFIG) and store your AppSecret and cached tokens in plaintext. (2) Understand the skill will create and execute temporary shell scripts in /tmp to run multi-line commands. (3) Use a least-privilege DingTalk application (only grant Document.Notable.Read/Write), ...详细分析 ▾
ℹ 用途与能力
The SKILL.md, references/api.md and scripts/dt_helper.sh all implement DingTalk Notable (AI 表格) API calls and require DingTalk application credentials and user identifiers; that is consistent with the skill name and description. However, the registry metadata declares no required env vars/credentials while the runtime instructions clearly require DINGTALK_APP_KEY, DINGTALK_APP_SECRET, DINGTALK_MY_USER_ID, DINGTALK_MY_OPERATOR_ID and DINGTALK_AI_TABLE_BASE_ID — a discrepancy that should be corrected.
ℹ 指令范围
The SKILL.md confines actions to obtaining tokens, converting userId↔unionId, and calling api.dingtalk.com / oapi.dingtalk.com endpoints. It instructs the agent to read/write a local config (~/.dingtalk-skills/config) via the included dt_helper.sh, to write multi-line commands to /tmp/<task>.sh and execute them. Those behaviors are explainable for this integration but mean credentials and tokens are written to disk and temporary scripts are executed — important operational details for users to accept consciously.
✓ 安装机制
No install spec or external downloads. This is an instruction-only skill with an included shell helper script; nothing is fetched from third-party URLs during installation.
ℹ 凭证需求
The credentials requested by the skill (app key/secret, userId/unionId, base_id) are appropriate for accessing DingTalk Notable APIs. However, the registry did not declare these required credentials at installation metadata level. The helper script stores app secret and tokens in plaintext under ~/.dingtalk-skills/config (or a path overridden by DINGTALK_CONFIG), which is typical for CLI helpers but increases local persistence risk and should be considered by the user.
ℹ 持久化与权限
always:false (normal). The skill writes and updates its own config file in the user's home directory and caches tokens there; it does not attempt to modify other skills or system-wide settings. The ability to run commands by creating /tmp scripts means it executes user-authorized actions on the machine at runtime — expected for a CLI-based helper but worth noting.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.32026/3/12
Version 0.1.3 - Added shell helper script `scripts/dt_helper.sh` to manage token, unionId conversion, and configuration read/write. - Updated usage guide: now mandates all configuration and token management via the helper script, with clear instructions for bash invocation and output handling. - Changed documentation in `SKILL.md` and `references/api.md`: implementation logic is more concise, focuses on workflow steps, and delegates full API details to lookup in `references/api.md`. - Improved configuration validation: only collects missing config items per-task, and outlines how to securely confirm config values.
● 无害
安装命令 点击复制
官方npx clawhub@latest install dingtalk-ai-table-only-curl
镜像加速npx clawhub@latest install dingtalk-ai-table-only-curl --registry https://cn.clawhub-mirror.com
技能文档
负责钉钉 AI 表格（.able 格式多维表格）的所有操作。本文件为策略指南，仅包含决策逻辑和工作流程。完整 API 请求格式见文末「references/api.md 查阅索引」。
核心概念
- AI 表格（
.able文件）：多维表格，使用 Notable API（/v1.0/notable），不是普通电子表格 - base_id：AI 表格文件的 nodeId，从分享链接
https://alidocs.dingtalk.com/i/nodes/提取 - 工作表（Sheet）：表格内的单张表，包含字段和记录
- 字段（Field）：列定义，有名称和类型（
text、number、date） - 记录（Record）：数据行，
fields中用字段名称（非 ID）作键 - operatorId：所有接口必须的 unionId 参数，通过
dt_helper.sh --to-unionid自动转换
工作流程（每次执行前）
- 先识别本次任务类型 → 例如：列工作表、创建字段、查询记录、更新记录、删除记录
- 按本次任务校验所需配置 → 通过
bash scripts/dt_helper.sh --get KEY读取；仅校验本任务必须项 - 仅收集缺失配置 → 若缺少某项，一次性询问用户所有缺失值，用
bash scripts/dt_helper.sh --set KEY=VALUE写入 - 获取 Token / operatorId → 直接调用
bash scripts/dt_helper.sh，token 获取与缓存细节无需关心 - 执行操作 → 凡是包含变量替换、管道或多行逻辑的命令，写入
/tmp/再.sh bash /tmp/执行。不要把多行命令直接粘到终端里（终端工具会截断），也不要用.sh <<'EOF'语法（heredoc 在工具中同样会被截断导致变量丢失）
按任务校验配置（必须先做）
- 所有任务通用必需：
DINGTALK_APP_KEY、DINGTALK_APP_SECRET、DINGTALK_MY_USER_ID - 涉及任何 AI 表格 API 调用：必须有
DINGTALK_MY_OPERATOR_ID（若缺失，先用bash scripts/dt_helper.sh --to-unionid自动转换并写回） - 工作表/字段/记录相关操作：必须有
DINGTALK_AI_TABLE_BASE_ID（若缺失，要求用户提供 AI 表格链接并提取/nodes/）
规则：未通过“本次任务配置校验”前，不得进入 API 调用步骤。
凭证禁止在输出中完整打印，确认时仅显示前 4 位 + *所需配置
| 配置键 | 必填 | 说明 | 如何获取 |
|---|---|---|---|
DINGTALK_APP_KEY | ✅ | 应用 AppKey | 钉钉开放平台 → 应用管理 → 凭证信息 |
DINGTALK_APP_SECRET | ✅ | 应用 AppSecret | 同上 |
DINGTALK_MY_USER_ID | ✅ | 当前用户的企业员工 ID（userId） | 管理后台 → 通讯录 → 成员管理 → 点击姓名查看 |
DINGTALK_MY_OPERATOR_ID | ✅ | 当前用户的 unionId（operatorId） | 首次由 bash scripts/dt_helper.sh --to-unionid 自动转换并写入 |
DINGTALK_AI_TABLE_BASE_ID | ✅ | AI 表格的 nodeId | 从 AI 表格分享链接 /nodes/ 提取 |
身份标识说明
| 标识 | 说明 |
|---|---|
userId（= staffId） | 企业内部员工 ID，可通过管理后台 -> 通讯录 -> 成员管理 -> 点击姓名查看 |
unionId | 跨企业/跨应用唯一标识，可通过 bash scripts/dt_helper.sh --to-unionid 获取 |
执行脚本模板
#!/bin/bash
set -e
HELPER="./scripts/dt_helper.sh"
NEW_TOKEN=$(bash "$HELPER" --token)
OPERATOR_ID=$(bash "$HELPER" --get DINGTALK_MY_OPERATOR_ID)
BASE_ID=$(bash "$HELPER" --get DINGTALK_AI_TABLE_BASE_ID)# 在此追加具体 API 调用，例如列出工作表：
SHEETS=$(curl -s -X GET "https://api.dingtalk.com/v1.0/notable/bases/${BASE_ID}/sheets?operatorId=${OPERATOR_ID}" \
-H "x-acs-dingtalk-access-token: $NEW_TOKEN")
echo "工作表列表: $SHEETS"
Token 失效处理*：dt_helper 仅按时间缓存，无法感知 token 被提前吊销。若 API 返回 401（token 无效/过期），用--nocache跳过缓存强制重新获取：> NEW_TOKEN=$(bash "$HELPER" --token --nocache)
references/api.md 查阅索引
确定好要做什么之后，用以下命令从references/api.md 中提取对应章节的完整 API 细节（请求格式、参数说明、返回值示例）：
grep -A 20 "^## 1. 列出工作表" references/api.md
grep -A 15 "^## 2. 查询单个工作表" references/api.md
grep -A 30 "^## 3. 创建工作表" references/api.md
grep -A 15 "^## 4. 删除工作表" references/api.md
grep -A 25 "^## 5. 列出字段" references/api.md
grep -A 28 "^## 6. 创建字段" references/api.md
grep -A 15 "^## 7. 更新字段" references/api.md
grep -A 15 "^## 8. 删除字段" references/api.md
grep -A 25 "^## 9. 新增记录" references/api.md
grep -A 40 "^## 10. 查询记录列表" references/api.md
grep -A 18 "^## 11. 更新记录" references/api.md
grep -A 15 "^## 12. 删除记录" references/api.md
grep -A 10 "^## 错误码" references/api.md
grep -A 6 "^## 所需应用权限" references/api.md
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制