← Back to Skills Marketplace
Use Dingding
by
brucezhu888
· GitHub ↗
· v1.1.0
· MIT-0
120
Downloads
0
Stars
0
Active Installs
9
Versions
Install in OpenClaw
/install use-dingding
Description
Interact with DingTalk workspace via dws CLI to manage contacts, chats, calendars, todos, approvals, attendance, reports, and AITable data using OAuth creden...
Usage Guidance
This skill appears to do what it says: it wraps the dws CLI and needs DingTalk OAuth credentials. Before installing, do the following: (1) Review the referenced GitHub repository and the raw install script before running any curl | sh; prefer building from source or downloading an official release. (2) Use least-privilege OAuth scopes and test in a sandbox enterprise first. (3) Prefer interactive login (keychain/libsecret) over environment variables for production. (4) Be cautious about granting the agent autonomous execution: require confirmations or disable autonomous invocation if you don't want automated approvals, message sends, or deletes. (5) Inspect the bundled scripts if you will run them; they call the dws binary via subprocess and operate on files you provide (CSV, message files), but they do not contain hidden network exfiltration code. (6) Rotate credentials and monitor audit logs after first use.
Capability Analysis
Type: OpenClaw Skill
Name: use-dingding
Version: 1.1.0
The skill bundle provides a comprehensive integration for DingTalk (Dingding) using the `dws` CLI. It includes several Python scripts in the `scripts/` directory to automate tasks like meeting scheduling, record importing, and task management. The documentation in `SKILL.md` and the `references/` folder is extensive and emphasizes security best practices, such as using `--dry-run` for all mutations and explicitly warning users to review external installation scripts from the project's GitHub repository (DingTalk-Real-AI/dingtalk-workspace-cli). No evidence of malicious intent, data exfiltration, or prompt injection attacks was found.
Capability Assessment
Purpose & Capability
Name/description promise (interact with DingTalk via the dws CLI) matches what the skill asks for: it requires DWS_CLIENT_ID and DWS_CLIENT_SECRET and documents use of the dws CLI. The bundled Python scripts call the dws binary via subprocess to perform calendar, contact, aitable, todo, report, and attendance operations — all coherent with the claimed purpose.
Instruction Scope
SKILL.md and scripts instruct the agent to run dws commands (including mutations like approvals, sends, deletes). The instructions explicitly recommend --dry-run by default and advise interactive login; the scripts themselves default to dry-run unless an explicit execute flag is passed. There are no instructions to read unrelated system files or to exfiltrate secrets, but the skill will access files the user explicitly supplies (CSV, message.md) and may use env vars if chosen. Because the skill can perform destructive org actions, limiting autonomous invocation or requiring manual confirmation is recommended.
Install Mechanism
There is no automated install spec in the package (instruction-only). SKILL.md points to GitHub releases and an install script (raw.githubusercontent.com) and suggests building from source. GitHub releases and source are reasonable installation sources; the provided curl | sh installer pattern is common but carries the usual risk—SKILL.md correctly asks reviewers to inspect the script before running it.
Credentials
Only DingTalk OAuth credentials (DWS_CLIENT_ID and DWS_CLIENT_SECRET) are declared as required, which is proportionate for a DingTalk CLI skill. The code and docs reference a small set of optional runtime envs (DWS_DEBUG, DWS_TRUSTED_DOMAINS) but nothing asks for unrelated cloud/provider credentials or broad secrets.
Persistence & Privilege
always is false and the skill does not request persistent platform-wide privileges or attempt to modify other skills/config. The only notable risk is functional: the skill can perform high-impact operations (approvals, deletes, send messages). Since autonomous invocation is allowed by default on the platform, restrict that when you don't want automated destructive actions — the SKILL.md also calls this out.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install use-dingding - After installation, invoke the skill by name or use
/use-dingding - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.1.0
- Add support for mapping CSV column names to AITable field names in import_records.py using a new --field-map argument.
- Update documentation in SKILL.md to reflect the new --field-map option for importing records.
- Improves bulk data migration workflows with flexible column/field alignment.
v1.0.9
- Version bump from 1.0.8 to 1.0.9 in SKILL.md.
- No functional, configuration, or documentation changes aside from updating the version number.
v1.0.8
- Shortened and clarified the front-matter metadata for environment and binary requirements.
- Simplified the description for faster overview of skill purpose and dependencies.
- Condensed and clarified the summary and instructions, removing excessive detail and duplication.
- Trimmed lengthy sections and removed incomplete or redundant content for better readability.
v1.0.7
- Added a dedicated dependencies section listing required binaries and environment variables for clearer setup.
- Updated metadata format to use required_binaries and required_env fields instead of requires/env.
- No changes to skill functionality or CLI usage.
v1.0.6
- Improved security guidance for authentication: recommends interactive login (secure keychain) over environment variables.
- Updated authentication section with clearer instructions and security warning about env vars visibility.
- No functional or breaking changes to core skill features.
v1.0.5
**All batch scripts now use safe dry-run mode by default; execution must be explicit.**
- All mutation scripts (e.g. create meeting or todos) now default to dry-run and require --execute to perform real changes.
- SKILL.md updated to clarify safe script usage and reduce accidental data mutations.
- Minor clarifications in documentation for batch script options.
- No changes to required credentials or core CLI commands.
v1.0.4
**Changelog for use-dingding 1.0.4**
- Updated SKILL.md metadata: renamed to "use-dingding" and added `displayName`, `version`, and `requires` sections.
- Explicitly documented required OAuth credentials (`DWS_CLIENT_ID`, `DWS_CLIENT_SECRET`) for authentication.
- No changes to functionality or CLI usage; documentation and metadata improvements only.
v1.0.3
- No user-facing changes in this release.
- Internal changes: updated the `clawhub.yml` file.
v1.0.2
Summary: Improved documentation and safety guidance for DingTalk Workspace Skill using the dws CLI.
- Expanded SKILL.md with detailed usage instructions and security warnings.
- Added step-by-step installation, authentication, and setup guides.
- Included safety tips: use --dry-run first, restrict autonomous execution, and apply least-privilege credentials.
- Provided quick reference examples for all 12 DingTalk workspace products (contact, chat, bot, calendar, todo, approval, attendance, report, aitable, etc.).
- Documented common workflows, troubleshooting steps, and output filtering options.
Metadata
Frequently Asked Questions
What is Use Dingding?
Interact with DingTalk workspace via dws CLI to manage contacts, chats, calendars, todos, approvals, attendance, reports, and AITable data using OAuth creden... It is an AI Agent Skill for Claude Code / OpenClaw, with 120 downloads so far.
How do I install Use Dingding?
Run "/install use-dingding" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Use Dingding free?
Yes, Use Dingding is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Use Dingding support?
Use Dingding is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Use Dingding?
It is built and maintained by brucezhu888 (@brucezhu888); the current version is v1.1.0.
More Skills