agentscope-ai/QwenPaw/src/qwenpaw/agents/skills/dingtalk_channel-en/SKILL.md
dingtalk_channel_connect
Use a headed browser to automatically complete DingTalk channel integration for QwenPaw. Applicable when the user mentions DingTalk, developer console, Client ID, Client Secret, bot, Stream mode, binding or configuring a channel. Supports pausing when a login page is detected and resuming after the user logs in.
- Source repository stars
- 33,124
- Declared platforms
- 0
- Static risk flags
- 0
- Last source update
- 2026-08-05
- Source checked
- 2026-08-05
Decision brief
What it does—and where it fits
This skill automates the creation of a DingTalk application and the binding of a QwenPaw channel using a headed browser.
Not for
- Tasks that require unconfirmed production actions or broad system permissions.
- Environments where the pinned source and install steps cannot be inspected.
Compatibility matrix
Platform support, with evidence labels
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Not declared | No explicit evidence | Portability before use |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
Inspect first. Install second.
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
npx skills add https://github.com/agentscope-ai/QwenPaw --skill "src/qwenpaw/agents/skills/dingtalk_channel-en"Inspect the Agent Skill "dingtalk_channel_connect" from https://github.com/agentscope-ai/QwenPaw/blob/2f34db2d7852f292e082953005e0b13b03fee3e3/src/qwenpaw/agents/skills/dingtalk_channel-en/SKILL.md at commit 2f34db2d7852f292e082953005e0b13b03fee3e3. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
What the source asks the agent to do
- 01
Step 1: Open the DingTalk Developer Console
1. Launch the browser in headed mode (headed: true) 2. Navigate to https://open-dev.dingtalk.com/ 3. Call snapshot to check if login is required
Launch the browser in headed mode (headed: true)Navigate to https://open-dev.dingtalk.com/Call snapshot to check if login is required - 02
Step 2: Create an Internal Enterprise Application
After the user confirms login, continue:
Navigate to the creation path:Application Development - Internal Enterprise Applications - DingTalk Applications - Create ApplicationFill in the application information (prefer user-customized values, otherwise use defaults): - 03
Step 3: Add Bot Capability and Publish
1. Click Add Application Capability under Application Capabilities, find Bot and add it 2. Toggle the switch button on the right side of Bot Configuration to enabled 3. Fill in Bot Name, Bot Brief, and Bot Description 4. Upload the Bot Icon (user-customized or default image): -…
Click Add Application Capability under Application Capabilities, find Bot and add itToggle the switch button on the right side of Bot Configuration to enabledFill in Bot Name, Bot Brief, and Bot Description - 04
Step 4: Create Version and Publish
1. Navigate to Application Release - Version Management & Release 2. Create a new version (required after every configuration change) 3. Fill in the version description; set the application visibility scope to all employees 4. Follow the page prompts to complete publishing; a ne…
Navigate to Application Release - Version Management & ReleaseCreate a new version (required after every configuration change)Fill in the version description; set the application visibility scope to all employees - 05
Step 5: Obtain Credentials
1. Navigate to Basic Information - Credentials & Basic Info 2. Inform the user that the Client ID (AppKey) and Client Secret (AppSecret) are on this page. Do not make changes proactively; guide the user to bind them on their own
Navigate to Basic Information - Credentials & Basic InfoInform the user that the Client ID (AppKey) and Client Secret (AppSecret) are on this page. Do not make changes proactively; guide the user to bind them on their own1. Navigate to Basic Information - Credentials & Basic Info 2. Inform the user that the Client ID (AppKey) and Client Secret (AppSecret) are on this page. Do not make changes proactively; guide the user to bind them on…
Permission review
Static risk signals and limitations
No configured static risk pattern was detected
This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.
Evidence record
Why each signal appears
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 88/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 33,124 | Source | Repository attention, not individual Skill quality |
| Compatibility | 0 platforms | Source | Declared in the catalog source record |
| Usage guide | automated source guide | Editorial | Generated or reviewed according to the visible evidence level |
Pinned source
Provenance and original SKILL.md
- Repository
- agentscope-ai/QwenPaw
- Skill path
- src/qwenpaw/agents/skills/dingtalk_channel-en/SKILL.md
- Commit
- 2f34db2d7852f292e082953005e0b13b03fee3e3
- License
- Apache-2.0
- Collected
- 2026-08-05
- Default branch
- main
View the original SKILL.md
DingTalk Channel Auto-Connect (Headed Browser)
This skill automates the creation of a DingTalk application and the binding of a QwenPaw channel using a headed browser.
Mandatory Rules
- Must launch in headed browser mode:
{"action": "start", "headed": true}
-
Must pause when a login gate is encountered:
- If the page displays a login screen (e.g., login prompt, QR code login, phone/password login), stop automated operations immediately.
- Clearly prompt the user to log in manually first, then wait for the user to reply with "logged in / continue".
- Do not proceed with subsequent steps until the user confirms.
-
Any application configuration change only takes effect after creating a new version and publishing:
- After configuring bot-related information, you must publish the bot.
- Whether creating a new application or modifying application information (name, description, icon, bot configuration, etc.), you must perform "create new version + publish" at the end.
- Do not claim the configuration is active if publishing has not been completed.
Pre-Execution Confirmation (Must Do First)
Before starting automated clicks, initiate a "configuration confirmation" with the user, clearly informing them of customizable fields, image specifications, and default values. Use the following structured confirmation:
-
Allow the user to customize the following fields:
- Application name
- Application description
- Bot icon image URL or local path
- Bot message preview image URL or local path
-
Clearly state the image specifications (prominently):
- Bot icon: JPG/PNG only,
240*240pxor larger,1:1ratio, under2MB, no rounded corners. - Bot message preview image: format
png/jpeg/jpg, no more than2MB.
- Bot icon: JPG/PNG only,
-
Clearly state the default values (used automatically if the user does not specify):
- Application name:
QwenPaw - Application description:
Your personal assistant - Bot icon:
https://img.alicdn.com/imgextra/i4/O1CN01M0iyHF1FVNzM9qjC0_!!6000000000492-2-tps-254-254.png - Bot message preview image:
https://img.alicdn.com/imgextra/i4/O1CN01M0iyHF1FVNzM9qjC0_!!6000000000492-2-tps-254-254.png
- Application name:
-
If the user provides no custom values, you must first explicitly reply:
- "All default settings will be used (QwenPaw / Your personal assistant / default images). Proceeding now."
Image Upload Strategy (Both link and path are supported)
- If the user provides a local path, use it directly for upload.
- If the user provides an image link, download it to a local temporary file first, then upload.
- The upload action sequence must be:
- First click the page upload entry (to trigger the chooser)
- Then call
file_uploadwith the local path array (paths_json)
- If the upload fails due to image specification mismatch (dimensions, ratio, size, format):
- Immediately pause automation
- Clearly ask the user to manually upload a compliant image
- After the user confirms "uploaded / continue", resume from the current step
Practical Upload Tips
- The
paths_jsonoffile_uploadmust be a "JSON string array" -- note the escaping:
{
"action": "file_upload",
"paths_json": "[\"xxx.png\"]",
"frame_selector": "iframe[src*=\"/fe/app?isHideOuterFrame=true\"]"
}
-
If the page is within an iframe, prefer including
frame_selector; otherwise the upload control may not be found or the chooser may not trigger. -
You must click the upload entry before calling
file_upload; calling it directly will result in:No chooser. Click upload then file_upload.
-
Common structural features of the bot icon area that can be used for locating elements (examples; these may appear as Chinese UI labels in the DingTalk console):
text: "* 机器人图标"(Bot Icon)button: "使用应用图标"(Use App Icon)button: "avatar"(usually containsimg "avatar"inside)
-
When the snapshot shows both "使用应用图标" ("Use App Icon") and "avatar", prefer clicking the
avatarbutton to trigger the upload, then callfile_upload.
Automation Flow
Step 1: Open the DingTalk Developer Console
- Launch the browser in headed mode (
headed: true) - Navigate to
https://open-dev.dingtalk.com/ - Call
snapshotto check if login is required
If login is required, pause with the following message:
Login to the DingTalk Developer Console is required. I have paused automated operations. Please complete the login in the opened browser. Reply "continue" when done, and I will resume from the current page.
Step 2: Create an Internal Enterprise Application
After the user confirms login, continue:
- Navigate to the creation path:
- Application Development -> Internal Enterprise Applications -> DingTalk Applications -> Create Application
- Fill in the application information (prefer user-customized values, otherwise use defaults):
- Application name: default
QwenPaw - Application description: default
Your personal assistant
- Application name: default
- Save and create the application
If the page text or structure does not match expectations, re-run snapshot and relocate elements based on visible text semantics.
Step 3: Add Bot Capability and Publish
- Click Add Application Capability under Application Capabilities, find Bot and add it
- Toggle the switch button on the right side of Bot Configuration to enabled
- Fill in Bot Name, Bot Brief, and Bot Description
- Upload the Bot Icon (user-customized or default image):
- Click the image below the bot icon label
- Default image URL:
https://img.alicdn.com/imgextra/i4/O1CN01M0iyHF1FVNzM9qjC0_!!6000000000492-2-tps-254-254.png - If it is a link, download to local first, then upload
- If the image does not meet specifications, pause and ask the user to manually upload a compliant image before continuing
- Upload the Bot Message Preview Image (user-customized or default image):
- Click the image below the bot message preview image label
- Default image URL:
https://img.alicdn.com/imgextra/i4/O1CN01M0iyHF1FVNzM9qjC0_!!6000000000492-2-tps-254-254.png - If it is a link, download to local first, then upload
- If the image does not meet specifications, pause and ask the user to manually upload a compliant image before continuing
- Confirm that the message receiving mode is set to
Stream Mode(the Chinese UI may displayStream 模式) - Select Publish; a further confirmation dialog will appear -- select publish. Note: you must publish the bot before proceeding to the next step
Step 4: Create Version and Publish
- Navigate to
Application Release -> Version Management & Release - Create a new version (required after every configuration change)
- Fill in the version description; set the application visibility scope to all employees
- Follow the page prompts to complete publishing; a new dialog will appear -- select confirm publish
- Only after seeing the successful publication status may you proceed with subsequent steps or tell the user "the configuration is now active"
Step 5: Obtain Credentials
- Navigate to
Basic Information -> Credentials & Basic Info - Inform the user that the
Client ID(AppKey) andClient Secret(AppSecret) are on this page. Do not make changes proactively; guide the user to bind them on their own
QwenPaw Binding Methods
After obtaining the credentials, guide the user to choose one of the following methods:
-
Console frontend configuration:
- In the QwenPaw console, go to
Control -> Channels -> DingTalk - Enter the
Client IDandClient Secret
- In the QwenPaw console, go to
-
Configuration file method:
"dingtalk": {
"enabled": true,
"bot_prefix": "[BOT]",
"client_id": "Your Client ID",
"client_secret": "Your Client Secret"
}
Path: ~/.qwenpaw/config.json, under channels.dingtalk.
Credential Delivery Requirements (Mandatory)
- The agent is only responsible for guiding the user to the credentials page, obtaining and displaying the
Client IDand the actualClient Secret. - The agent must not proactively modify the
consoleconfiguration or~/.qwenpaw/config.json. - You must instruct the user to fill in the credentials manually using one of the following two methods:
- Console frontend:
Control -> Channels -> DingTalk - Configuration file: edit the
channels.dingtalkfield in~/.qwenpaw/config.json
- Console frontend:
Browser Tool Usage Pattern
Execute in the following order by default:
startwithheaded: trueopensnapshotclick/type/select_option/press_keyas needed- frequent
snapshotafter page transitions stopwhen done
Stability and Recovery Strategy
- Prefer using the
reffrom the latestsnapshot; only useselectorwhen necessary. - After each critical click or navigation, use a short wait (
wait_for) and immediately re-runsnapshot. - If the session expires or re-login is required mid-flow, pause again and wait for the user to log in before continuing from the current step.
- If automation is blocked by tenant permissions or admin approval, clearly describe the blocker and ask the user to manually complete that step before resuming.
Alternatives
Compare before choosing
mission69b/t2000
sui-publish
Publishing, upgrading, and deploying Sui Move packages. Use this skill when the user needs to publish a package, upgrade a published package, deploy to multiple networks, serialize transactions for multisig signing, run a local Sui network (localnet), prepare for Mainnet launch, monitor production deployments, or debug dry run failures. Also use when the user asks about sui client publish, sui client upgrade, UpgradeCap, upgrade policies, Published.toml, --serialize-output, localnet, mainnet lau
teng-lin/notebooklm-py
notebooklm
Complete API for Google NotebookLM - full programmatic access including features not in the web UI. Create notebooks, add sources, generate all artifact types, download in multiple formats. Activates on explicit /notebooklm or intent like "create a podcast about X"
TencentCloudBase/CloudBase-AI-Toolkit
cloudbase-agent-python
Build production-ready AI agent backends using the CloudBase Agent Python SDK — create agents with LangGraph/CrewAI/LlamaIndex, serve them via FastAPI with AG-UI protocol streaming + OpenAI-compatible endpoints, add tools (bash, filesystem, MCP, code execution), memory (in-memory, TDAI, MySQL, MongoDB), observability (OpenTelemetry/Langfuse), and middleware (auth, logging). Use this skill when the user wants to create an AI agent server, build a chatbot backend, set up human-in-the-loop workflow
ok-helloworld/vibe-pentest
race-condition
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.