dingtalk-channel-connect
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill enforces secure operational practices by requiring a visible (headed) browser mode and explicitly instructing the agent to halt automation and wait for manual user intervention whenever a login screen is encountered.
- [SAFE]: The process for handling sensitive DingTalk credentials (Client ID and Client Secret) is designed to keep the user in control. The skill directs the agent to guide the user to the credentials page rather than attempting to capture or exfiltrate them automatically.
- [SAFE]: The skill uses default assets from a well-known and expected service provider ("img.alicdn.com", an official Alibaba/DingTalk CDN) for bot icons and previews.
- [SAFE]: Instructions for configuring local files (e.g.,
~/.researchclaw/config.json) follow standard software practices for the mentioned integration and do not involve unauthorized file system access or credential theft.
Audit Metadata