Webhook Robot

Send messages to various webhook-based bots (WeCom, DingTalk, Feishu, etc.).

This skill appears to do what it says (send webhook messages). Before installing or using it: (1) review the scripts yourself (they are bundled and readable). (2) Avoid passing secret tokens on long-lived command lines—prefer secure config files or protected env vars if you adapt the scripts. (3) Be cautious about allowing autonomous/unsupervised use: the scripts accept arbitrary URLs, so an untrusted prompt could cause the agent to send requests to internal network endpoints. (4) Note the SKILL.md mentions a not-yet-implemented config.json; expect to supply keys/tokens via CLI until you implement safer storage. If you plan to use this in production, run it in a network-isolated environment and rotate tokens used for testing.

Type: OpenClaw Skill Name: webhook-robot Version: 1.1.0 The skill bundle is designed to send messages to various webhook-based services. While the core functionality is benign, the `scripts/send_gocqhttp.py` script allows specifying an arbitrary URL (`--url`) for the GoCqHttp API. This capability, while necessary for its stated purpose, introduces a potential Server-Side Request Forgery (SSRF) vulnerability if the agent's input is not adequately sanitized, allowing an attacker to direct the agent to make requests to internal network resources or other arbitrary external hosts. This is a risky capability without clear malicious intent within the script itself, thus classifying it as suspicious rather than malicious.