Dooray Hook

Send automated notifications to Dooray! messenger channels via webhooks.

This skill appears to do exactly what it claims: read Dooray webhook URLs from your ~/.openclaw/openclaw.json and POST messages to them. Before installing, ensure: (1) The webhook URLs in your OpenClaw config are stored securely (restrict file permissions, do not commit them to version control). (2) You understand that setting verify_ssl: false disables TLS certificate checks — avoid this unless you trust the network/proxy. (3) The agent may be allowed to call the skill autonomously by default; if you want to prevent automated outbound messages, restrict agent permissions or invocation. If you prefer not to store secrets in a global JSON file, consider keeping webhooks in a more secure secret store or environment mechanism and adapting the script accordingly.

Type: OpenClaw Skill Name: openclaw-dooray-hook-skill Version: 0.1.1 The skill is classified as suspicious due to the explicit option to disable SSL certificate verification (`verify_ssl: false`) in `scripts/send_dooray.py`. While this feature is configurable by the user, defaults to secure, and is documented as a troubleshooting step for specific environments (e.g., corporate proxies, self-signed certificates), it introduces a potential Man-in-the-Middle (MITM) vulnerability if enabled in an untrusted network. There is no evidence of malicious intent, data exfiltration, or other harmful activities; the risk lies in this configurable insecure network communication option.