Send Markdown-formatted messages with type and @mentions to DingTalk group chats via bot webhook with optional signature verification.

This skill appears to do exactly what it says: send Markdown messages to a DingTalk group via a webhook and optional signing secret. Before installing: (1) Verify and trust the webhook URL you provide — the webhook is a secret that can post into your group, so keep it private. (2) Note that the registry metadata omitted required env vars; you must set DINGTALK_WEBHOOK (and DINGTALK_SECRET if you use signing) or create the config file at ~/.config/dingtalk-push/config.json. (3) The skill reads config from your home config directory and the current working directory — avoid putting secrets in repositories or public folders. (4) The source has no homepage and an unknown owner; if you need higher assurance, review the small JS files yourself (they are readable and straightforward) or ask the author for provenance. (5) No external installs or unexpected network endpoints were found — the code only calls the provided webhook. If you plan to allow autonomous agent invocation, be aware the agent could send messages using that webhook, so restrict who can enable the skill and where the webhook posts.

Type: OpenClaw Skill Name: dingtalk-push Version: 0.1.0 The skill is classified as suspicious due to two main vulnerabilities in `send.js`. Firstly, the `DINGTALK_WEBHOOK` is loaded from environment variables or configuration files, meaning if these sources are compromised, the skill could be coerced into sending messages to an arbitrary, attacker-controlled endpoint. While this is a configuration vulnerability rather than direct malicious intent by the skill, it represents a significant risk. Secondly, user-provided `message` and `title` inputs are directly embedded into Markdown without explicit sanitization by the skill, which could allow for Markdown injection (e.g., phishing links, external image loads for tracking) if an attacker controls the input, potentially impacting DingTalk users.