DingTalk Workspace CLI is a cross-platform command-line tool that brings DingTalk’s product capabilities into one interface. It serves human users and AI agents working with DingTalk enterprise data, with administrator authorization required. Its catalogue add-ons provide agent skills for using the CLI’s product areas.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DingTalk-Real-AI/dingtalk-workspace-cli --skill dingtalk-chatgit clone --depth 1 https://github.com/DingTalk-Real-AI/dingtalk-workspace-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat)<a href="https://agentmods.dev/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat"><img src="https://agentmods.dev/badge/skills/dingtalk-real-ai/dingtalk-workspace-cli/dingtalk-chat.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 14 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 14 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 43 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 44 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 45 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02448 |
| Opus 5 | $0.00036 | $0.01224 |
| Sonnet 5 | $0.00014 | $0.00490 |
| Haiku 4.5 | $0.00007 | $0.00245 |
Grade C, and why
dingtalk-chat scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
| <!-- dws-intent: chat.send.dm -->按姓名发简单文本或 Markdown | `dws chat +dm --to <姓名> --content <内容>` | CLI 解析唯一用户；多候选时停止，不先手工查 ID | How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
钉钉群聊 / 消息 Skill
最小 DWS 执行契约
- 只通过
dwsCLI 操作钉钉；结构化读取使用--format json，按真实返回判断结果。 - 已知命令直接执行。只有 leaf 参数或安全语义不确定时读取精确 Schema，只有 Cobra flag 不确定时读取精确 leaf Help；不要加载产品级 Catalog 代替选路。
- 不猜命令、flag、字段、ID、账号或时间。后续 ID 必须来自真实返回；零命中、多候选或类型不明时停止并消歧。
- 解析目标、读取上下文和最终执行必须使用同一 profile；不得跨组织复用 userId、openDingTalkId 或 openConversationId。多账号组织只使用明确的
isOrgCurrent=true默认账号；没有默认账号时要求用户指定，禁止选择第一项、最近登录或最近使用账号。 - 不输出或记录 token、refresh token、appSecret、webhook token 等凭据；宿主已注入认证时不要索要凭据。
- 写操作必须符合用户明确意图。是否需要确认以最终 Runtime gate 和 Schema 为准；需要确认时先说明对象、动作与影响，再追加
--yes。 - 写后按任务结果契约验证；不能仅凭退出码宣称成功。部分结果、未知投递状态和失败项必须如实保留。
- 时间戳面向用户展示时转换为带时区的可读时间；默认使用当前会话时区，必要时同时保留原值。
- 遇到认证、权限、profile、confirmation 或未知错误时，只加载
dingtalk-shared中对应 reference；不要连续猜测替代命令。
Shortcut 发现（Shortcut-first）
chat 有 93 条 canonical Shortcut：根 Help 展示 26 条 Featured，另 67 条在 Catalog、Schema 和精确 Help；5 条 public 兼容入口从根 Help 省略，2 条 unavailable 不参与默认选路。
优先按 Golden Route、意图表或 reference 选 Shortcut；仅在所需底层参数或原始响应未覆盖时使用 atomic。低频发现用 dws shortcut list --service chat --format json；参数/安全查 compact leaf Schema，flags 查所选 Shortcut 的精确 Help。
Golden Route
按用户任务选择最小充分入口。公开层按意图分流；Resolver、发送执行、消息投影和错误契约在 Runtime 内复用，不把所有能力塞进一个万能命令。
| 用户意图 | 唯一推荐入口 | 关键边界 |
|---|---|---|
| 按姓名发简单文本或 Markdown | dws chat +dm --to <姓名> --content <内容> |
CLI 解析唯一用户；多候选时停止，不先手工查 ID |
| 按群名或 ID 发简单文本或 Markdown | dws chat +send-to-group --group <群名或ID> --content <内容> |
稳定 ID 直接使用；群名多候选时停止 |
| 文件、Bot、Webhook、复杂 @ 或高级发送 | dws chat +messages-send |
Bot 多群用 --groups/--groups-file 并检查逐项 ledger |
| 读取指定会话、返回较多消息 | dws chat +chat-messages |
粗粒度读取；目标条件明确时优先 +search-msg |
| 多维度条件搜索（发送者/关键词/@/类型，单/跨会话） | dws chat +search-msg |
目标条件明确时使用 |
| 按成员 ID 或姓名创建群聊 | dws chat +chat-create |
姓名用 --member-query 由 CLI 唯一解析，不先手工搜索 |
| 引用回复一条已有消息 | dws chat +messages-reply |
使用真实消息与会话 ID；未知投递状态不得写成成功送达 |
| 查看指定群成员（用户/机器人） | dws chat +chat-members-list --group <群名或ID> |
唯一解析并全量读取 |
| 获取群邀请链接 | dws chat +chat-invite-url --group <群名或ID> |
多候选时停止 |
| 查看群机器人 | dws chat +chat-bots --group <群名或ID> |
返回稳定 bots[] |
| 管理群身份 | 按动作使用 +chat-role-list / +chat-role-add / +chat-role-update / +chat-role-remove / +chat-role-set-user / +chat-role-remove-user / +chat-role-query-user |
--group 接受群名或 ID；定义删除用单数 --role-id，成员设置/移除用复数 --role-ids |
| 管理个人会话分类 | +category-create → +category-add-conversation → +category-list-conversations → +category-delete；读取全部用 +category-list |
分类不是聊天群；高频生命周期直接走 shortcut，详情读 chat-conversation.md |
| 个人收藏表情列表/发送/收藏 | dws chat emotion list/send/favorite |
约束见 leaf Schema |
| 修改群名称 | dws chat +chat-update --group <群名或openConversationId> --name <新名称> |
Shortcut 内统一解析群名或稳定 ID；多候选时停止，不直接调用 atomic group rename |
| 查看指定群内 @我的消息 | dws chat +at-me --group <群名> --page-all |
检查 complete；空结果仍返回数组 |
| 查看全部会话 | dws chat +conversation-list --page-all |
检查 complete / failures |
| 读取并下载消息资源 | 查询命令加 --download-resources |
不另起手工下载循环；下载失败项保留在结果中 |
| 查看置顶会话 | dws chat +conversation-list-top |
会话 Top 与消息 Pin、消息 Top、Favorite 不同 |
| 监听未来 IM 事件 | dingtalk-event |
常规监听走 +listen-im；生命周期/高级控制走 consume |
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/01-messaging.md 6.5 KB
- references/card/callback.md 469 B
- references/card/create.md 1.7 KB
- references/card/schema.md 2.4 KB
- references/card/update.md 830 B
- references/chat-emoji-list.md 9.0 KB
- references/chat.md 8.5 KB
- references/chat/chat-bot.md 9.8 KB
- references/chat/chat-conversation.md 8.8 KB
- references/chat/group-admin.md 7.6 KB
- references/chat/group-discovery.md 5.9 KB
- references/chat/message-actions.md 6.1 KB
- references/chat/message-media.md 3.7 KB
- references/chat/message-query.md 7.3 KB
- references/chat/thread.md 3.9 KB
- references/contracts.md 4.4 KB
- references/intent-guide.md 3.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -24 lines 546ea9c38b47
- 5d ago Changed 4bb432f4fc9a
- 8d ago First seen · 128 lines · 71 tokens per session scan C ccbd7d2db7c5
dingtalk-chat is a skill published in the GitHub repository DingTalk-Real-AI/dingtalk-workspace-cli (2,875 stars, last pushed today), licensed Apache-2.0. It adds 71 tokens to every session and 2,448 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orbit-notion
Open Orbit briefing skill — selected by the Orbit pipeline when Notion is the user's only connected connector, or when the user explicitly scopes their daily digest to Notion. Pulls the past 24 hours of document edits, comments, mentions, and database row changes from the user's authenticated Notion connection and…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
peekaboo
Capture and automate macOS UI with the Peekaboo CLI.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.