从钉钉开放平台获取员工考勤数据，并保存到本地或推送到指定渠道。

What to consider before installing/running: - This skill does require DingTalk credentials (DINGTALK_APP_KEY and DINGTALK_APP_SECRET, plus optional agent/app IDs) even though the registry metadata lists none — do not paste secrets into chat; store them only in the .env in the skill directory as instructed. - The repo includes Node and Python code. Review index.js, export_excel.py and any config.json before running. index.js will call DingTalk APIs and save data locally under data/attendance and data/excel. - The Python exporter will automatically attempt to pip-install openpyxl at runtime if not present (export_excel.py uses os.system('pip install openpyxl -q')). That causes network access and package installation — if you prefer control, pre-install dependencies yourself (pip install -r requirements.txt and npm install) and remove/disable the auto-install line. - SKILL.md and README are inconsistent: SKILL.md's npm install step omits dotenv (which index.js requires), and SKILL.md says it won't use config.json but index.js will read config.json as a fallback. Treat those as documentation bugs and verify actual behavior locally. - Run initially in an isolated environment (VM, container, or isolated project), as the code will perform network calls to oapi.dingtalk.com and may install packages from registries. - Verify that the application will only be given minimal DingTalk permissions required for the task and that the hosting environment has least privilege (don't run as root). Consider rotating credentials after initial tests. - If you need higher assurance: audit package-lock.json / package.json for dependencies, run 'npm audit' and 'pip audit' (or equivalent), and consider removing the auto-install behavior or pinning dependency versions before production use. Overall: the functionality matches the stated purpose, but the manifest/instructions inconsistencies and the runtime auto-install behavior make this suspicious rather than clearly benign. Inspect and run it in an isolated/test environment and address the documentation and install issues before trusting it with production credentials.

Type: OpenClaw Skill Name: keplerjai-dingtalk-attendance Version: 1.0.0 The skill bundle is designed to fetch DingTalk attendance data and generate Excel reports. It is classified as suspicious due to high-risk execution patterns, specifically the use of 'os.system' in 'export_excel.py' to automatically install Python dependencies and 'child_process.exec' in 'index.js' to run shell commands. While the 'index.js' script implements date validation to mitigate command injection, these behaviors represent significant security vulnerabilities. The 'SKILL.md' file contains well-defined instructions to prevent the AI agent from leaking API credentials (AppKey/AppSecret) into the chat interface, which is a positive security measure.