MateClaw is a pluggable agent runtime that coordinates AI agents, tools, conversations, memory, and workflows. It is designed for personal and multi-user AI assistants, including agents used through chat platforms. Catalogue add-ons provide skills for extending its agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mateaix/mateclaw --skill dingtalk_channel_connectgit clone --depth 1 https://github.com/mateaix/mateclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mateaix/mateclaw/dingtalk_channel_connect)<a href="https://agentmods.dev/skills/mateaix/mateclaw/dingtalk_channel_connect"><img src="https://agentmods.dev/badge/skills/mateaix/mateclaw/dingtalk_channel_connect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mateaix/mateclaw/dingtalk_channel_connect"><img src="https://agentmods.dev/badge/skills/mateaix/mateclaw/dingtalk_channel_connect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.01242 |
| Opus 5 | $0.00019 | $0.00621 |
| Sonnet 5 | $0.00008 | $0.00248 |
| Haiku 4.5 | $0.00004 | $0.00124 |
Grade A, and why
dingtalk_channel_connect scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
command="curl -L -o /tmp/bot_icon.png \"<图片URL>\"" How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
钉钉渠道接入(可见浏览器)
通过可见浏览器自动化完成钉钉应用创建与 MateClaw 渠道绑定。
强制规则
- 必须使用可见浏览器:
browser_use(action="start", headed=true) - 遇到登录页必须暂停:检测到登录界面立即停止,提示用户手动登录,收到"继续"后再执行
- 配置变更后必须发布:任何机器人配置修改都要"创建新版本 + 发布",否则不生效
执行前确认(必须先做)
开始自动化前向用户确认以下可定制项(未指定则使用默认值):
| 配置项 | 默认值 |
|---|---|
| 应用名称 | MateClaw |
| 应用描述 | Your personal AI assistant |
| 机器人图标 | https://img.alicdn.com/imgextra/i4/O1CN01M0iyHF1FVNzM9qjC0_!!6000000000492-2-tps-254-254.png |
| 机器人消息预览图 | 同上 |
图片规范(务必告知用户):
- 机器人图标:JPG/PNG,240×240px 以上,1:1 比例,2MB 以内
- 消息预览图:PNG/JPEG/JPG,不超过 2MB
图片上传策略
- 用户提供本地路径 → 直接上传
- 用户提供图片链接 → 先下载到本地临时文件,再上传
下载图片(跨平台):
macOS / Linux:
execute_shell_command(
command="curl -L -o /tmp/bot_icon.png \"<图片URL>\""
)
Windows:
execute_shell_command(
command="powershell Invoke-WebRequest -Uri '<图片URL>' -OutFile 'C:\\Temp\\bot_icon.png'"
)
上传步骤(必须按此顺序):
- 先
browser_use(action="click", selector="<上传入口>")触发文件选择器 - 再用文件上传操作(MateClaw browser_use 支持 file input 的
type操作传入路径)
自动化流程
步骤 1:打开钉钉开发者后台
browser_use(action="start", headed=true)
browser_use(action="open", url="https://open-dev.dingtalk.com/")
browser_use(action="snapshot")
若页面显示登录界面,立即暂停:
检测到需要登录钉钉开发者后台。请在弹出的浏览器中完成登录,完成后回复"继续"。
步骤 2:创建企业内部应用
用户确认登录后:
- 导航路径:应用开发 → 企业内部应用 → 钉钉应用 → 创建应用
- 填写应用名称、应用描述
- 保存创建
# 每次关键操作后都要截快照确认状态
browser_use(action="snapshot")
步骤 3:添加机器人能力
- 进入「应用能力」→「添加应用能力」→ 找到「机器人」并添加
- 打开机器人配置开关
- 填写机器人名称、简介、描述
- 上传机器人图标(见图片上传策略)
- 上传消息预览图
- 确认消息接收模式为 Stream 模式
- 点击发布 → 确认发布弹窗
发布是必须步骤,未发布前配置不生效。
步骤 4:创建版本并发布
- 进入「应用发布」→「版本管理与发布」
- 创建新版本,填写版本说明
- 应用可见范围选「全部员工」
- 确认发布(有二次确认弹窗,选确认)
- 看到「发布成功」状态才继续
步骤 5:获取凭证并引导绑定
- 进入「基础信息」→「凭证与基础信息」
- 告知用户
Client ID(AppKey)和Client Secret(AppSecret)的位置 - 引导用户在 MateClaw 控制台绑定:
方式 A — 控制台前端:
进入 MateClaw 管理界面 → 渠道 → 新建渠道 → 选择钉钉 → 填入 Client ID 和 Client Secret
方式 B — 配置文件:
"dingtalk": {
"enabled": true,
"client_id": "你的 Client ID",
"client_secret": "你的 Client Secret"
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 141 lines · 38 tokens per session scan A b18778b9dac4
dingtalk_channel_connect is a skill published in the GitHub repository mateaix/mateclaw (1,092 stars, last pushed yesterday), licensed Apache-2.0. It adds 38 tokens to every session and 1,242 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pentest-client-advanced
Advanced client-side attacks — CORS misconfiguration, WebSocket security, clickjacking, postMessage abuse, CSS injection, and browser storage vulnerabilities.
add-tavily-tool
Add Tavily Search and Extract as keyless remote MCP tools for selected NanoClaw agent groups. Use when installing Tavily web search or URL extraction without an API key.
agent-browser
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
browser-cdp
Use this skill when you need to control a Chrome browser via CDP (Chrome DevTools Protocol) to reuse existing login sessions. Covers: launching Chrome in debug mode, opening URLs, waiting for page load, evaluating JavaScript, taking snapshots, and extracting auth tokens. Trigger phrases: browser automation, CDP…
browser-automation
Playwright-based browser automation patterns for autonomous web interaction.
unbrowse
One-call web access for agents with cache-first API replay and browser capture on misses. Unbrowse passively learns first-party route DAGs while browsing, independently validates replay, and keeps remote sharing consented and fail-closed. Prefer it over WebFetch, curl, and browser loops.