← 返回 Skills 市场

dida365-ticktick-agent

Name: dida365-ticktick-agent
Author: superowenx

作者 whaaatsup · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

342

总下载

当前安装

版本数

在 OpenClaw 中安装

/install dida365-ticktick-agent

功能描述

滴答清单任务管理。管理你的滴答清单任务，包括查看项目、创建任务、完成任务、查询完成历史等。

使用说明 (SKILL.md)

dida365 - 滴答清单管理

管理你的滴答清单任务。

前置要求

Node.js 18+
npm 或 pnpm

安装

npm install -g dida365-ai-tools

认证配置

第一步：获取 Cookie

登录网页版滴答清单 https://dida365.com
按 F12 打开开发者工具
切换到 Application 标签
左边找到 Cookies > https://dida365.com
复制 t cookie 的值

第二步：配置环境变量

export DIDA365_CLIENT_ID="你的_client_id"
export DIDA365_CLIENT_SECRET="你的_client_secret"

注意：Client ID 和 Secret 需要去滴答清单开发者平台 https://developer.dida365.com/ 注册应用获取。如果使用 Cookie 认证，只需要设置 Cookie 即可。

第三步：保存 Cookie

dida365 auth cookie "你的cookie值"

使用命令

查看项目列表

dida365 project list

查看项目任务

dida365 project show \x3CprojectId>

创建任务

dida365 task create "\x3C标题>" -p \x3CprojectId>

完成任务

dida365 task complete \x3CprojectId> \x3CtaskId>

查看今日完成

dida365 completed today

查看本周完成

dida365 completed week

同步所有数据

dida365 sync all

项目 ID

运行以下命令查看你的项目 ID：

dida365 project list

常见项目类型：

收集箱 (Inbox)
自定义项目

OpenClaw 集成

在 OpenClaw 中使用，可以创建一个 wrapper 脚本：

#!/bin/bash
export DIDA365_CLIENT_ID="你的_client_id"
export DIDA365_CLIENT_SECRET="你的_client_secret"
dida365 "$@"

保存为 dida365 并添加到 PATH，然后在飞书里直接调用命令即可。

安全使用建议

Before installing: 1) Verify the npm package (dida365-ai-tools) author, read its code or repository and check npmjs.org for the package and maintainers. 2) Prefer registering an OAuth app and using scoped credentials over copy-pasting session cookies; avoid pasting full cookies into tools you don't trust. 3) Don't put client_secret or session cookies in global shell startup files or world-readable scripts; use a secure secret store or local-only environment for the CLI. 4) If you must test, run the CLI in a sandboxed environment (container or throwaway VM) and inspect where it stores auth tokens (file paths, permissions). 5) The registry metadata contradicts the README — ask the publisher to correct the manifest or provide the package source before trusting credentials.

功能分析

Type: OpenClaw Skill Name: dida365-ticktick-agent Version: 1.0.0 The skill bundle provides instructions for integrating an external CLI tool, `dida365-ai-tools`, for managing Dida365 tasks. The `SKILL.md` file details installation, authentication (using environment variables or cookies), and usage commands. There is no evidence of prompt injection attempts against the agent, nor any instructions for malicious actions such as data exfiltration, unauthorized command execution, or persistence. The instructions are clear, align with the stated purpose, and guide the user on how to configure and use the `dida365` command-line utility.

能力评估

ℹ Purpose & Capability

The declared purpose (manage dida365/TickTick tasks) aligns with needing API credentials or a session cookie. Asking for a client_id/client_secret and a session cookie can be legitimate for this integration. However, the registry metadata lists no required env vars or credentials while SKILL.md explicitly instructs setting DIDA365_CLIENT_ID and DIDA365_CLIENT_SECRET and saving a 't' cookie — that inconsistency is suspicious.

⚠ Instruction Scope

Runtime instructions tell the user to extract a browser 't' cookie via Developer Tools and run a CLI command to save it. They also show exporting client secrets into environment variables and creating a wrapper that embeds those exports. These steps involve handling sensitive tokens and give the installed CLI full access to the user's Dida365 account. The instructions do not say where the cookie/credentials are stored or how they are protected.

ℹ Install Mechanism

There is no formal install spec in the registry, but SKILL.md tells users to run `npm install -g dida365-ai-tools`. Installing a third‑party global npm package is a moderate-risk operation because arbitrary code will be placed on the system — this is expected for a Node-based CLI but the package source and code should be reviewed before installation.

⚠ Credentials

The skill asks for DIDA365_CLIENT_ID, DIDA365_CLIENT_SECRET and a session cookie, which are sensitive. The registry declares no required environment variables; that mismatch means the metadata understates the credential footprint. Requiring both OAuth client credentials and a raw session cookie may be redundant and increases attack surface if the CLI mishandles them.

ℹ Persistence & Privilege

The skill does not request 'always' or any system-wide config changes. It suggests creating a wrapper script placed on PATH (normal for CLIs). There is no sign the skill demands elevated or persistent platform privileges beyond installing a global npm package and storing credentials locally.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install dida365-ticktick-agent
安装完成后，直接呼叫该 Skill 的名称或使用 /dida365-ticktick-agent 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release with major structural and usage changes: - CLI tool renamed from ticktick-official-cli to dida365. - All Python scripts and OpenAPI references removed; rewritten as a Node.js-based CLI. - Updated documentation to reflect new commands and environment variables. - Supports both Cookie and OAuth authentication, with simple onboarding. - Added commands for project/task management, viewing completed tasks, and global sync. - Installation now via npm (npm install -g dida365-ai-tools).

元数据

Slug dida365-ticktick-agent

版本 1.0.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 1

常见问题