← 返回 Skills 市场
leegodamn

Kim Msg Skill

作者 LeeGoDamn · GitHub ↗ · v1.2.0
cross-platform ⚠ suspicious
449
总下载
0
收藏
1
当前安装
8
版本数
在 OpenClaw 中安装
/install kim-msg
功能描述
快手 Kim 即时通讯消息发送。支持 Webhook(群聊)和消息号(指定用户)两种方式,内置智能密钥加载和 fallback 机制。适用于通知、告警、日报等场景。官网:https://kim.kuaishou.com/
使用说明 (SKILL.md)

Kim 消息发送(快手 IM)

概述

Kim 是快手的企业即时通讯工具,支持两种发送消息的方式:

  1. Webhook 方式 - 需要 Kim 机器人 Token,向机器人所在的群聊发送消息
  2. 消息号方式 - 需要 appKey + secretKey,可以直接发送给指定用户(快手邮箱前缀)

官方网站:https://kim.kuaishou.com/

首次配置

首次使用前,需要选择一种方式并配置相应的凭证:

Webhook 方式

需要从 Kim 机器人获取 Webhook Token,告诉晴晴帮你配置。

消息号方式

需要提供:

  • appKey: Kim 应用 Key
  • secretKey: Kim 应用 Secret
  • 用户名: 要发送消息的目标用户(必须是快手邮箱前缀,如 wangyang,不是完整邮箱 [email protected]

使用方法

方式一:Webhook 发送

# 发送 Markdown 消息到群聊
kim-msg/webhook.sh "**标题**\
\
正文内容"

# 发送纯文本
kim-msg/webhook.sh "Hello World" --text

方式二:消息号发送

推荐:使用包装脚本(自动加载密钥)

# 发送消息给指定用户(用户名必须是邮箱前缀,如 wangyang)
kim-msg/send.sh -u \x3C邮箱前缀> -m "消息内容"

# 示例
kim-msg/send.sh -u wangyang -m "**提醒**:今天有会议"

或直接调用 Node 脚本(需自行设置环境变量)

export KIM_APP_KEY=your_app_key
export KIM_SECRET_KEY=your_secret_key
kim-msg/message.js -u \x3C邮箱前缀> -m "消息内容"

⚠️ 首次使用如果遇到权限错误,运行:chmod +x scripts/*.sh

API 详情

Webhook

  • URL: https://kim-robot.kwaitalk.com/api/robot/send?key=\x3Ckey>
  • Method: POST
  • Body:
{
  "msgtype": "markdown",
  "markdown": {"content": "消息内容"}
}

消息号

  • 获取 Token: https://is-gateway.corp.kuaishou.com/token/get?appKey=\x3CappKey>&secretKey=\x3CsecretKey>
  • 发送消息: 自动尝试以下两个接口:
    • 单用户:/openapi/v2/message/sendusername 单个用户)
    • 批量:/openapi/v2/message/batch/sendusernames 数组)
    • 自动重试: 优先尝试单用户接口,失败则尝试批量接口
  • Headers: Authorization: Bearer \x3Ctoken>
  • Body:
{
  "msgType": "markdown",
  "markdown": {"content": "消息内容"},
  "usernames": ["用户名"]
}

密钥配置方式

优先级:环境变量 > 密钥文件

脚本内置智能密钥加载机制,按以下优先级查找:

  1. 环境变量(最高优先级)

    • KIM_WEBHOOK_TOKEN(Webhook 方式)
    • KIM_APP_KEY / KIM_SECRET_KEY(消息号方式)
  2. 密钥文件(自动 fallback)

    如果环境变量未设置或发送失败,脚本会自动从以下位置查找密钥(按优先级):

    • ~/.openclaw/.secrets(OpenClaw 统一密钥管理)
    • ~/.kim_credentials(Kim 专用密钥文件)
    • ./kim_credentials(项目本地密钥文件)

    文件格式:

    KIM_APPKEY=your_app_key
    KIM_SECRET=your_secret_key
    

    Webhook Token 格式:

    KIM_WEBHOOK_TOKEN=your_webhook_token
    

💡 提示:

  • 密钥文件权限建议设置为 600(仅所有者可读写):chmod 600 ~/.openclaw/.secrets
  • 触发 fallback 时,脚本会输出警告提示,但不会暴露密钥文件路径
  • 推荐本地开发使用密钥文件,CI/CD 使用环境变量

注意事项

  • 不硬编码任何 API Key/Token
  • 消息内容需合规
  • API 异常时检查凭证和网络
  • 用户名必须是快手邮箱前缀(如 wangyang),不是完整邮箱

源码

GitHub: https://github.com/LeeGoDamn/kim-msg-skill

安全使用建议
Before installing, be aware of three things: 1) Metadata mismatch — the registry entry lists no required env vars or config paths but the scripts require KIM_WEBHOOK_TOKEN or KIM_APP_KEY/KIM_SECRET_KEY and will search ~/.openclaw/.secrets, ~/.kim_credentials, and ./kim_credentials. Expect the skill to read those files. 2) Least-privilege recommendation — prefer exporting the specific KIM_* environment variables rather than keeping a broad ~/.openclaw/.secrets file that may contain unrelated credentials. If you must use files, set strict permissions (chmod 600) and verify the file contents only include what you intend to expose. 3) Code review and provenance — the code contacts only Kim endpoints documented in SKILL.md, but the package lacks a homepage and the source is listed as unknown; SKILL.md and README reference a GitHub repo. Inspect that upstream repository (and commit history), verify checksums, and run the scripts in a safe environment (or test account) if you have sensitive secrets in ~/.openclaw/.secrets. If you cannot inspect the files or prefer not to risk reading shared secrets, reject or sandbox the skill and supply credentials via dedicated environment variables instead.
功能分析
Type: OpenClaw Skill Name: kim-msg Version: 1.2.0 The kim-msg skill is a legitimate tool designed to send messages via the Kuaishou Kim IM platform using Webhooks or the Message Number API. The scripts (send.sh, webhook.sh, and message.js) implement a credential-loading mechanism that checks environment variables and local configuration files (e.g., ~/.openclaw/.secrets) specifically for its own required keys (KIM_APPKEY, KIM_SECRET, KIM_WEBHOOK_TOKEN). All network communication is directed to official Kuaishou domains (corp.kuaishou.com and kwaitalk.com), and the code contains no evidence of data exfiltration, malicious execution, or prompt injection.
能力评估
Purpose & Capability
Name/description, README, SKILL.md and scripts all describe sending Kim messages via webhook or appKey/secret, which matches the code. However the skill metadata declares no required env vars or config paths even though the scripts require KIM_WEBHOOK_TOKEN or KIM_APP_KEY/KIM_SECRET_KEY and will look in ~/.openclaw/.secrets, ~/.kim_credentials, and ./kim_credentials. The omission in metadata is an incoherence that hides what the skill actually needs to access.
Instruction Scope
The runtime instructions and shipped scripts explicitly read environment variables and fall back to reading local credential files in the user's home and current directory. They only contact the Kim endpoints described in SKILL.md and do not call unexpected external endpoints, but the fallback behavior reads a potentially broad 'Unified secrets' file (~/.openclaw/.secrets) which may contain unrelated secrets. The SKILL.md claims the script will not expose file paths, but it does read those files locally — this scope expansion should be called out to users.
Install Mechanism
No install script or remote downloads are present — the skill ships small local scripts and a Node script only. No installers or external archives are fetched, so installation risk is low.
Credentials
The credentials the code needs (KIM_WEBHOOK_TOKEN, KIM_APP_KEY, KIM_SECRET_KEY) are proportionate to the stated purpose. But the skill metadata does not declare these env vars or the config file paths. More importantly, the fallback will open ~/.openclaw/.secrets which is described as 'OpenClaw unified key management' and could contain many unrelated secrets — reading that file for a single-service key is broader access than a user might expect.
Persistence & Privilege
The skill does not request permanent/always-on inclusion, does not modify other skills or system-wide config, and does not persist credentials beyond using environment variables or local files. It runs only when invoked.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install kim-msg
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /kim-msg 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.2.0
feat: 智能密钥加载与 fallback 机制 - 支持多路径密钥文件自动查找(~/.openclaw/.secrets, ~/.kim_credentials, ./kim_credentials) - 优先级:环境变量 > 密钥文件 - 发送失败时自动 fallback 到密钥文件 - 触发 fallback 时输出警告(不暴露文件路径) - 更新 SKILL.md 和 README.md 文档 - 改进错误提示和故障排查指南
v1.1.3
修复 message.sh 后缀名(Node.js 脚本改为 .js)+ 新增 send.sh 包装脚本(自动加载密钥)
v1.1.2
添加权限问题说明
v1.1.1
添加权限问题说明
v1.1.0
支持单用户和批量用户双接口自动重试
v1.0.2
添加快手/Kim官网描述
v1.0.1
支持 Webhook 和消息号两种发送方式
v1.0.0
初始版本 - 发送消息到 Kim 群聊
元数据
Slug kim-msg
版本 1.2.0
许可证
累计安装 1
当前安装数 1
历史版本数 8
常见问题

Kim Msg Skill 是什么?

快手 Kim 即时通讯消息发送。支持 Webhook(群聊)和消息号(指定用户)两种方式,内置智能密钥加载和 fallback 机制。适用于通知、告警、日报等场景。官网:https://kim.kuaishou.com/. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 449 次。

如何安装 Kim Msg Skill?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install kim-msg」即可一键安装,无需额外配置。

Kim Msg Skill 是免费的吗?

是的,Kim Msg Skill 完全免费(开源免费),可自由下载、安装和使用。

Kim Msg Skill 支持哪些平台?

Kim Msg Skill 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Kim Msg Skill?

由 LeeGoDamn(@leegodamn)开发并维护,当前版本 v1.2.0。

💬 留言讨论