DingTalk Workspace CLI is a cross-platform command-line tool that brings DingTalk’s product capabilities into one interface. It serves human users and AI agents working with DingTalk enterprise data, with administrator authorization required. Its catalogue add-ons provide agent skills for using the CLI’s product areas.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DingTalk-Real-AI/dingtalk-workspace-cli --skill dingtalk-chatgit clone --depth 1 https://github.com/DingTalk-Real-AI/dingtalk-workspace-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat)<a href="https://agentmods.dev/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat"><img src="https://agentmods.dev/badge/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat"><img src="https://agentmods.dev/badge/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 14 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 14 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 43 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 44 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.02665 |
| Opus 5.5 | $0.00036 | $0.01066 |
| Sonnet 5.5 | $0.00018 | $0.00533 |
| Haiku 4.5 | $0.00009 | $0.00266 |
Grade C, and why
dingtalk-chat scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
| <!-- dws-intent: chat.send.dm -->按姓名发文本/Markdown | `dws chat +dm --to <姓名> --content <内容>` | 唯一解析；多候选停止 | How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
群聊/消息
最小 DWS 执行契约
- 只用
dws；结构化读取加--format json，按真实返回判断。 - 已知命令直调；参数/约束/安全不明查 leaf 窄 Schema。Schema 不可用才读已知 leaf Help 一次；
unknown flag用同 leaf Help 修正一次。unknown command不查 Help：优先错误中的明确 suggestion，其次已加载 Skill/reference 中的明确兼容入口；均无则报漂移并停，禁全 Catalog。低频 reference 不默认 Help，禁 root/parent/product Help。发现后必须执行或说明阻塞。 - 不猜命令/flag/字段/ID/账号/业务事实；ID 来自真实返回。目标零命中/多候选/类型不明先消歧；仅可选时间/展示范围用契约默认，缺必需信息即停。
- 解析/读/写同一 profile，ID 不跨组织。多账号只用唯一
isOrgCurrent=true；否则用户指定，禁止选择第一项、最近登录或最近使用账号。 - 不输出/记录 token、refresh token、appSecret、webhook token；已注入认证时不索要。
- 写须符合明确意图；确认以最终 Runtime gate/Schema 为准，确认后才加
--yes。 - 写后验证结果，不凭退出码宣称成功。退出须最终答复，区分完成、部分、阻塞、待确认、失败；保留已有数据及
complete/hasMore/stopReason/failures。 - 时间戳按会话时区展示，必要时保留原值。
- 认证/权限/profile/confirmation/未知错误只读
dingtalk-shared对应 reference，禁连续猜替代命令。
对象与路由边界
openConversationId是会话，messageId/openMessageId是消息，openTaskId是发送任务，不可混用。- 会话分组/分类走
category，群聊/聊天群走chat group；会话列表无正文，总结/统计读消息。Pin/Top/Favorite 不是分类。
Shortcut 发现（Shortcut-first）
按 Golden Route/reference 选 Shortcut；仅缺底层字段用 atomic，低频走 reference/Catalog。
参数查 dws schema --cli-path "chat <leaf>" --compact --jq '{cli_path,parameters,constraints,confirmation}' -f json；仅需且已发布 result 时查 outcomes/pagination，字段级再查 data_schema；缺失不以 Help/样例推断。Schema 不可用才读一次已知 leaf Help；unknown flag 用同 leaf Help 修正一次。unknown command 禁 Help：错误 suggestion → 已加载 Skill/reference 明确入口；均无则报漂移。禁全 Catalog/root/parent/product Help；低频 reference 不默认 Help。
Golden Route
| 用户终点 | 唯一推荐入口 | 关键边界 |
|---|---|---|
| 读取指定群聊/单聊 | dws chat +chat-messages --no-reactions |
全部时加 --page-all |
| 按关键词/发送者/@/类型/reaction 过滤 | dws chat +search-msg（reaction 加 --has-reactions） |
默认 7 天；范围用 --start/--end |
| 跨会话读取/总结/统计 | dws chat message list-all --start <开始> --end <结束> --page-all --no-reactions |
不先列会话逐群循环 |
| 时间后活跃会话 | dws chat +recent-conversations --start <时间> |
摘要；查 complete；+active-conversations 仅兼容 |
| 查看 @我的消息 | dws chat +at-me [--group <群名或ID>] --page-all --no-reactions |
未指定群则跨会话；默认 7 天 |
| 查看未读消息 | dws chat +unread-chats |
需正文时沿 CID 读消息 |
| 已知消息 ID 批量取详情 | dws chat +messages-mget |
看 leaf Schema；保留会话上下文 |
| 按姓名发文本/Markdown | dws chat +dm --to <姓名> --content <内容> |
唯一解析；多候选停止 |
| 按群名/ID 发文本/Markdown | dws chat +send-to-group --group <群名或ID> --content <内容> |
多候选停止 |
| 图文/文件/Bot/Webhook/复杂 @ | dws chat +messages-send |
本地图文先读资源；Bot 多群检查逐项 ledger |
| 全部会话 | dws chat +conversation-list --page-all |
含群聊/单聊，非正文 |
| 查加入/管理的群 | +my-groups --page-all / +chat-list-mine |
后者无 --page-all；flag 不跨 leaf |
| 搜群或查看全部成员 | +chat-search --query <词> / +chat-members-list --group <群名或ID> |
多候选停止；检查 buckets/完整性 |
| 查群资料/Bot/邀请链接 | +conversation-info / +chat-bots / +chat-invite-url |
只读 |
| 创建/清理临时群 | dws chat +chat-create --name <名称> --member-query <姓名列表> → 保存 CID → +chat-dismiss --group <cid> |
已知 ID 用 --users；清理须确认、验证 |
| 改群资料/设置/禁言/管理员 | +chat-update / +chat-update-settings / +chat-mute / +chat-mute-member / +chat-set-admin |
用真实群/用户 ID；写后读回 |
| 管理群身份 | 读 group-admin 角色 family | 角色 CRUD、成员绑定/解绑/查询；不切 atomic，写后回读 |
| 列分类内会话 | dws chat +category-list-conversations --category-id <ID> |
分类≠群；先取 ID |
| 引用回复 | dws chat +messages-reply |
用真实消息/CID；未知投递状态非成功 |
| 撤回/转发 | +messages-recall；+messages-forward / +messages-combine-forward / +messages-forward-topic |
不复制正文冒充原生转发 |
| Pin/消息 Top/Favorite | +messages-set-pin / +messages-unset-pin；+messages-set-top / +messages-unset-top；+flag-create / +flag-cancel |
对象互不替代；用对应查询验证 |
| 添加/移除 reaction | +messages-add-emoji / +messages-remove-emoji |
扩展动作读 message-actions |
| 会话置顶/免打扰/隐藏 | chat-conversation | 用真实 CID；会话 Top 非消息 Top |
| 已读/未读/清红点/清空 | +conversation-mark-read / +conversation-mark-unread / +conversation-clear-red-point / +conversation-clear-all-red-point / +conversation-clear-messages |
已读需消息 ID；清空按 Runtime 确认 |
| 下载消息资源 | 查询加 --download-resources --output-dir <目录>；已有引用用 +messages-resource-download |
不猜 ID；保留 ledger；临时 URL 不交付 |
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/01-messaging.md 6.5 KB
- references/card/a2ui.md 9.4 KB
- references/card/callback.md 857 B
- references/card/create.md 1.7 KB
- references/card/schema.md 3.9 KB
- references/card/update.md 830 B
- references/chat-emoji-list.md 9.0 KB
- references/chat.md 11 KB
- references/chat/chat-bot.md 10 KB
- references/chat/chat-conversation.md 10 KB
- references/chat/group-admin.md 8.9 KB
- references/chat/group-discovery.md 5.9 KB
- references/chat/message-actions.md 6.2 KB
- references/chat/message-media.md 5.7 KB
- references/chat/message-query.md 11 KB
- references/chat/thread.md 3.5 KB
- references/contracts.md 5.5 KB
- references/intent-guide.md 3.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines · +9 tokens per session e1ffcc8c47a4
- 9d ago Changed · -1 lines 19f84b2d0a69
- 1mo ago Changed · -1 lines · -31 tokens per session 8911f4c15e69
- 1mo ago Changed · +1 lines · +40 tokens per session 70ea860bda62
- 1mo ago Changed · +1 lines c50899538a11
- 1mo ago Changed · -24 lines 546ea9c38b47
- 1mo ago Changed 4bb432f4fc9a
- 1mo ago First seen · 128 lines · 71 tokens per session scan C ccbd7d2db7c5
dingtalk-chat is a skill published in the GitHub repository DingTalk-Real-AI/dingtalk-workspace-cli (3,788 stars, last pushed 2d ago), licensed Apache-2.0. It adds 89 tokens to every session and 2,665 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orbit-notion
Open Orbit briefing skill — selected by the Orbit pipeline when Notion is the user's only connected connector, or when the user explicitly scopes their daily digest to Notion. Pulls the past 24 hours of document edits, comments, mentions, and database row changes from the user's authenticated Notion connection and…
agentmail
Use your assigned AgentMail inbox to read email tasks, explicitly send or reply, and check delivery. Provided automatically by your inbox assignment.
rowboat-spaces
How to work as a member of Rowboat Spaces, the team chat where people and agents work together. Load it once per session, before acting on any request that reaches you from Rowboat; it covers your setup, mentions and hand-offs, the tools, and files.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.