Skills/ClawHub/dingtalk-auto-reply

dingtalk-auto-reply@0.1.7

CAUTION· static only

Publisher claims: "监控钉钉未读会话，单聊用 AI 以本人身份自动回复（普通员工口吻、平级回同事），群聊/指定名单只发微信提醒（不代发，防社死）。覆盖 dws 未读接口、CodeBuddy Agent SDK 生成回复的 SERVER__PORT 端口冲突坑、自报家门坑、回复自己坑。当用户要求「钉钉自动回复/钉钉代回/监听钉钉未读+AI回复」时使用。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher noaheleven · publishing for 99 daysInstalls 1,020Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-07 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file paths_validate.py:459 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 2b) 声明的 SDK python（.env 的 CODEBUDDY_SDK_PYTHON）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsgen_launcher.py:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files' Run with the skill dir as CWD so .env resolves even if launched elsewhereFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdingtalk_unread_monitor.py:729 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# SDK 自拉起：若本进程用的 python 没装 codebuddy-agent-sdk，但 .env 里Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_validate.py:466 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(" 修复: 跑 _setup_env.py 重新探测写入；或手动修正 .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdingtalk_unread_monitor.py:731 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# （保留 os.environ，子进程重启时会再次读 .env）。这样无论监控被哪个 python 拉起，Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsruntime.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 轻量 .env 加载器（零依赖，保证可移植）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_setup_env.py:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files写入技能目录下的 .env。这样：Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_setup_env.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files· 后续 agent 读 .env 即可「识别」SDK 环境，不必重新探测。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_setup_env.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ENV_EXAMPLE = os.path.join(_SKILL_DIR, ".env.example")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_setup_env.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""_setup_env.py —— 安装时探测并写入 SDK 运行环境到 .env。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files├── .gitignore # 隐私黑名单（.env / _media_cache / .vbs 等不随包分发）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdingtalk_unread_monitor.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- runtime.py 基础/配置层：.env 加载、SDK 可用探测、路径探测、全部共享常量、日志/锁/缓存/审计/鉴权Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths_setup_env.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ENV_PATH = os.path.join(_SKILL_DIR, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files├── .env.example # 配置样例（cp .env.example .env 后填写真实身份/Key）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdingtalk_api.py:494 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 隐私：源码不硬编码真实姓名，请在私密 .env 里配 BOSS_DISPLAY_NAME=你的钉钉显示名Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files├── runtime.py # 基础/配置层：.env 加载、SDK 可用探测、路径探测、全部共享常量、日志/锁/缓存/审计/鉴权Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:179 · MCP server using network transport (SSE/HTTP) — data sent over network- 回复 agent 经 SDK 的 `mcp_servers` 挂上 gbrain（`reply.py` 内 `CodeBuddyAgentOptions(mcp_servers={"gbrain": {"type":"http","url":...,"headers":...}})`），**按需调用** `mcp__gbrain__search` / `mcp__gbrain__query` Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detected_setup_env.py:58 · Python subprocess execution detectedr = subprocess.run([py, "-c", "import codebuddy_agent_sdk; print('OK')"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandgen_launcher.py:34 · Process kill command — agent can terminate processes' -> stuck (e.g. dws child hung / silent spin) -> kill + relaunch next cycle.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detecteddingtalk_api.py:32 · Python subprocess execution detected故一律用临时文件承接 stdout（subprocess.run(stdout=file) → dws 同步落盘 → read），Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsruntime.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# ---------- 轻量 .env 加载器（零依赖，保证可移植） ----------Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification command_validate.py:494 · File permission modification command — agent changes file ownership/permissionsprint(" dws patch chmod 授权 chat.message:list / chat.message:send / contact:search")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsruntime.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""加载 .env 到 os.environ（已存在的环境变量不被覆盖，.env 只补缺）。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)runtime.py:287 · MCP server using network transport (SSE/HTTP) — data sent over network# 回复 agent 经 mcp_servers 直连 gbrain HTTP 端点，调用 search/query 做语义检索（更快更准）。Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedreply.py:1108 · Python subprocess execution detectedr = subprocess.run([NODE, SEND_JS, text], timeout=30,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandgen_launcher.py:63 · Process kill command — agent can terminate processesMAX_STALE_SEC = 180 ' log stale > 180s = monitor stuck, kill + restartFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsruntime.py:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""把 .env 文本解析为 {KEY: VALUE} 字典（纯函数，供 _load_env_file /Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detecteddingtalk_api.py:40 · Python subprocess execution detectedr = subprocess.run(cmd, stdout=f, stderr=subprocess.PIPE, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈10,677 tok
1 file · 16 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim noaheleven: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim noahelevenPropose a patch to the maintainer