Agent skill · Audited from source

qqbot-cron

skill · sliverp/qqbotMIT licenceAudited 20 Oct 2026 · source 151fa9c1620e

★ 1,550pushed 8 days ago
✕BLOCKGrade D · 69/100 · 12 findings · 151fa9c
1,550repo stars · whole sliverp/qqbot

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 151fa9c1620e and observed filesystem and network access and no hard-coded secrets. The audit raised 12 findings, 1 critical or high. What it does: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “qqbot-cron (sliverp/qqbot)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/sliverp/qqbot-cron

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Privilege escalation / persistence” in src/utils/platform.ts:403. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score69/100✕BLOCK D
0 critical1 high3 medium2 low6 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemDeclared2 observations
  • NetworkDeclared7 observations
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS2
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL5
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS5
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (12)

HIGHPrivilege escalation / persistencepriv.escalate · src/utils/platform.ts:403
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
: "⚠️ ffmpeg 未安装。语音/视频格式转换将受限。安装方式: sudo apt install ffmpeg 或 sudo yum install ffmpeg"
Why
asks for elevated privileges
Fix
—
MEDIUMInformation disclosuredisclose.log_secret · bin/qqbot-cli.js:181
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`  ${foundInstallation} channels add --channel qqbot --token "…"`);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMInformation disclosuredisclose.log_secret · bin/qqbot-cli.js:206
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`  ${cmd} channels add --channel qqbot --token "…"`);
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.system_paths · src/utils/platform.ts:275
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"/usr/local/bin/ffmpeg",   // Mac brew
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .orange-ci.yml
F-13 Inventory / provenanceCWE-1104Layer L0
.orange-ci.yml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@tencent-connect/qqbot-nodejs, @types/node, tsup, typescript
Why
4 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOInventory / provenanceinv.oversize · docs/images/lighthouse-head.png
F-13 Inventory / provenanceCWE-1104Layer L0
docs/images/lighthouse-head.png
Why
1449103 bytes not read
Fix
—
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.md:137
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.md:161
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.zh.md:137
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
Why
No further detail recorded for this rule.
Fix
—
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.zh.md:161
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionscope.undeclared_system · <declared scope>
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
system use found in code, not declared in the description
Why
the description does not admit a capability the code has
Fix
declare system use in the description, or remove it

Audit 0.4.1 · source sha 151fa9c1620e · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishersliverp GitHub organizationOwner of the repository this skill is read from
  • Source foldersliverp/qqbotThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict151fa9c1620eA new audit runs when the source changes
  • Repository statusNot archivedLast push 8 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。

---
name: qqbot-channel
description: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。
metadata: {"openclaw":{"emoji":"📡","requires":{"config":["channels.qqbot"]}}}
---

# QQ 频道 API 请求指导

> **本 Skill 仅处理 QQ 频道(Guild/Channel)操作。** 频道 ID 为纯数字,API 路径为 `/guilds/...` 和 `/channels/...`。

`qqbot_platform_api` 是 QQ 开放平台统一 HTTP API 网关,**自动填充鉴权 Token**。你只需要指定 HTTP 方法、API 路径、请求体和查询参数即可调用频道相关接口。

---

## 🔀 适用范围(必读)

QQ 频道是类似 Discord 的社区产品,层级结构为 **频道(Guild) → 子频道(Channel)**:

| 层级 | 中文名 | 英文 | API 路径 | ID 格式 |
|------|--------|------|----------|---------|
| 顶层 | 频道 | Guild | `/guilds/{guild_id}` | 纯数字(如 `123456`) |
| 次级 | 子频道 | Channel | `/channels/{channel_id}` | 纯数字(如 `789012`) |

**核心特征**:
- 频道内可以创建多个子频道(文字、语音、论坛、直播等)
- 支持发帖、公告、日程等功能
- 频道成员通过 `/guilds/{guild_id}/members` 管理
- ID 为纯数字格式,API 路径以 `/guilds/` 或 `/channels/` 开头

**触发关键词**:频道、子频道、guild、channel、帖子、日程、公告、论坛、频道成员

## 📚 详细参考文档

每个接口的完整参数说明、返回值结构和枚举值定义:
- `references/api_references.md`

---

## 🔧 工具参数

| 参数 | 类型 | 必填 | 说明 |
|------|------|------|------|
| `method` | string | 是 | HTTP 方法:`GET`, `POST`, `PUT`, `PATCH`, `DELETE` |
| `path` | string | 是 | API 路径(不含域名),如 `/guilds/{guild_id}/channels`,需替换占位符为实际值 |
| `body` | object | 否 | 请求体 JSON(POST/PUT/PATCH 使用) |
| `query` | object | 否 | URL 查询参数键值对,值为字符串类型 |

> 基础 URL:`https://api.sgroup.qq.com`,鉴权头 `Authorization: QQBot {token}` 由工具自动填充。

---

## ⭐ 接口速查

### 频道(Guild)

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取频道列表 | `GET` | `/users/@me/guilds` | query: `before`, `after`, `limit`(最大100) |
| 获取频道 API 权限 | `GET` | `/guilds/{guild_id}/api_permission` | — |

### 子频道(Channel)

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取子频道列表 | `GET` | `/guilds/{guild_id}/channels` | — |
| 获取子频道详情 | `GET` | `/channels/{channel_id}` | — |
| 创建子频道 | `POST` | `/guilds/{guild_id}/channels` | body: `name`\*, `type`\*, `position`\*, `sub_type`, `parent_id`, `private_type`, `private_user_ids`, `speak_permission`, `application_id` |
| 修改子频道 | `PATCH` | `/channels/{channel_id}` | body: `name`, `position`, `parent_id`, `private_type`, `speak_permission`(至少一个) |
| 删除子频道 | `DELETE` | `/channels/{channel_id}` | ⚠️ 不可逆 |

**子频道类型(type)**:`0`=文字, `2`=语音, `4`=分组(position≥2), `10005`=直播, `10006`=应用, `10007`=论坛

### 成员(Member)

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取成员列表 | `GET` | `/guilds/{guild_id}/members` | query: `after`(首次填0), `limit`(1-400) |
| 获取成员详情 | `GET` | `/guilds/{guild_id}/members/{user_id}` | — |
| 获取身份组成员列表 | `GET` | `/guilds/{guild_id}/roles/{role_id}/members` | query: `start_index`(首次填0), `limit`(1-400) |
| 获取在线成员数 | `GET` | `/channels/{channel_id}/online_nums` | — |

### 公告(Announces)

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 创建公告 | `POST` | `/guilds/{guild_id}/announces` | body: `message_id`, `channel_id`, `announces_type`(0=成员,1=欢迎), `recommend_channels`(最多3条) |
| 删除公告 | `DELETE` | `/guilds/{guild_id}/announces/{message_id}` | message_id 设 `all` 删除所有 |

### 论坛(Forum)— 仅私域机器人

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取帖子列表 | `GET` | `/channels/{channel_id}/threads` | — |
| 获取帖子详情 | `GET` | `/channels/{channel_id}/threads/{thread_id}` | — |
| 发表帖子 | `PUT` | `/channels/{channel_id}/threads` | body: `title`\*, `content`\*, `format`(1=文本,2=HTML,3=Markdown,4=JSON,默认3) |
| 删除帖子 | `DELETE` | `/channels/{channel_id}/threads/{thread_id}` | ⚠️ 不可逆 |
| 发表评论 | `POST` | `/channels/{channel_id}/threads/{thread_id}/comment` | body: `thread_author`\*, `content`\*, `thread_create_time`, `image` |

### 日程(Schedule)

| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 创建日程 | `POST` | `/channels/{channel_id}/schedules` | body: `{ schedule: { name*, start_timestamp*, end_timestamp*, jump_channel_id, remind_type } }` |
| 修改日程 | `PATCH` | `/channels/{channel_id}/schedules/{schedule_id}` | body: `{ schedule: { name*, start_timestamp*, end_timestamp*, jump_channel_id, remind_type } }` |
| 删除日程 | `DELETE` | `/channels/{channel_id}/schedules/{schedule_id}` | ⚠️ 不可逆 |

**提醒类型(remind_type)**:`"0"`=不提醒, `"1"`=开始时, `"2"`=5分钟前, `"3"`=15分钟前, `"4"`=30分钟前, `"5"`=60分钟前

> `*` 表示必填参数

---

## 💡 调用示例

### 获取频道列表

```json
{
  "method": "GET",
  "path": "/users/@me/guilds",
  "query": { "limit": "100" }
}
```

### 获取子频道列表

```json
{
  "method": "GET",
  "path": "/guilds/123456/channels"
}
```

### 创建子频道

```json
{
  "method": "POST",
  "path": "/guilds/123456/channels",
  "body": {
    "name": "新频道",
    "type": 0,
    "position": 1,
    "sub_type": 0
  }
}
```

### 获取成员列表(分页)

```json
{
  "method": "GET",
  "path": "/guilds/123456/members",
  "query": { "after": "0", "limit": "100" }
}
```

### 发表论坛帖子

```json
{
  "method": "PUT",
  "path": "/channels/789012/threads",
  "body": {
    "title": "公告标题",
    "content": "# 标题\n\n公告内容",
    "format": 3
  }
}
```

### 创建日程

```json
{
  "method": "POST",
  "path": "/channels/456789/schedules",
  "body": {
    "schedule": {
      "name": "周会",
      "start_timestamp": "1770733800000",
      "end_timestamp": "1770737400000",
      "remind_type": "2"
    }
  }
}
```

### 创建推荐子频道公告

```json
{
  "method": "POST",
  "path": "/guilds/123456/announces",
  "body": {
    "announces_type": 0,
    "recommend_channels": [
      { "channel_id": "789012", "introduce": "欢迎来到攻略频道" }
    ]
  }
}
```

### 删除所有公告

```json
{
  "method": "DELETE",
  "path": "/guilds/123456/announces/all"
}
```

---

## 🔄 常用操作流程

### 获取频道和子频道信息

```
1. GET /users/@me/guilds → 获取频道列表,拿到 guild_id
2. GET /guilds/{guild_id}/channels → 获取子频道列表,拿到 channel_id
3. GET /channels/{channel_id} → 获取子频道详情
```

### 论坛发帖 + 评论

```
1. GET /guilds/{guild_id}/channels → 找到论坛子频道(type=10007)
2. PUT /channels/{channel_id}/threads → 发表帖子
3. GET /channels/{channel_id}/threads → 获取帖子列表
4. GET /channels/{channel_id}/threads/{thread_id} → 获取帖子详情(含 author_id)
5. POST /channels/{channel_id}/threads/{thread_id}/comment → 发表评论
```

### 成员管理

```
1. GE

Excerpt, first 6,006 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 151fa9c

npm install --omit=dev

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 151fa9c1620e only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 151fa9c1620e

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/sliverp/qqbot-cron/badge.svg)](https://modelsatlas.com/skills/sliverp/qqbot-cron/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/sliverp/qqbot-cron/badge.svg)](https://modelsatlas.com/skills/sliverp/qqbot-cron/)

Questions about qqbot-cron

What does the qqbot-cron skill do?
qqbot
Is qqbot-cron safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can qqbot-cron access on my machine?
The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does qqbot-cron work with?
Its documentation mentions openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (151fa9c1620e), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.