Code Pluginsource linked

Openclaw Channel Dingtalkv3.6.4

DingTalk (钉钉) channel plugin for OpenClaw

@soimy/dingtalk·runtime dingtalk·by @soimy

Community code plugin. Review compatibility and verification before install.

openclaw plugins install clawhub:@soimy/dingtalk

Latest release: v3.6.4Download zip

Capabilities

Compatibility

Built With Open Claw Version

2026.3.28

Min Gateway Version

>=2026.3.28

Plugin Api Range

>=2026.3.28

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Suspicious

high confidence

Purpose & Capability

The DingTalk channel purpose fits the package overall: it connects OpenClaw to DingTalk, handles messages/media/cards, sends replies, and supports DingTalk docs APIs. However, owner-triggered learning commands can persist rules globally, by session, or by target, and exact-match rules can force deterministic replies; that is high-impact behavior beyond ordinary channel transport.

Instruction Scope

Learning rules are injected as high-priority constraints and the prompt text tells the model not to reveal the rule source. Manual forced replies are resolved before normal handling and can silently replace responses after an owner adds matching rules.

ℹ

Install Mechanism

The package uses a standard OpenClaw/npm plugin structure with no install lifecycle script found. It is source-linked but has no provenance attestation; dependencies are installed as part of normal plugin setup.

Credentials

Network access to DingTalk and credential use are expected, but the plugin also reads local OpenClaw session files for peer preload, supports file-based secrets from arbitrary configured paths, logs full callback/streaming payloads in some paths, and stores message-derived learning data.

Persistence & Privilege

Persistent state includes full question/answer snapshots, feedback records, pending card content, target sets, and learned rules. There are disable/delete commands, but no clear audit, approval, retention, or safety review around global/target rule injection.

Scan Findings in Context

[SDI-2] unexpected: The inspected code confirms persistent manual learning rules, hidden high-priority learning context, and exact-match forced replies. Owner gating reduces exposure but does not remove the material concern because these rules can silently alter future outputs.

[SSD-1] unexpected: The /learn command surface is owner-restricted, but it accepts arbitrary natural-language rules and can persist them across scopes, including global and multi-target application.

[SSD-4] unexpected: The code supports identity discovery, target enumeration/listing, target-set creation, and bulk rule application, creating a powerful control plane if owner access is misused or compromised.

[SQP-2] unexpected: Several findings were confirmed: full card streaming payloads and raw callback payloads can be logged, and pending card/learning state can store user or model message content.

[SSD-3] expected: Storing feedback and reply snapshots is related to the learning feature, but retaining full questions/answers without clear minimization, encryption, or retention controls remains a review concern.

[SDI-4] unexpected: The redaction helper only masks token/accessToken keys, so the scanner's concern about incomplete masking is supported by the source.

[suspicious.env_credential_access] expected: Environment-variable credential access is expected for a DingTalk channel that supports env-based secret references and contacts DingTalk APIs.

[suspicious.exposed_secret_literal] expected: The inspected static-scan examples appear to be config/schema field names such as clientSecret/accessToken rather than hardcoded secrets, so this static signal is downgraded.

What to consider before installing

Install only if you are comfortable granting this plugin DingTalk bot credentials, message send capability, DingTalk docs access through gateway methods, local persistent storage, and owner-controlled learning rules. Before using it in production, restrict ownerAllowFrom, prefer allowlists for DM/group access, keep learningEnabled and learningAutoApply off unless needed, avoid file-based secrets unless the config is trusted, and do not enable debug logging for sensitive conversations.

✗

dist/index.js:90

Environment variable access combined with network send.

✗

dist/index.js:167