Agent skill · Audited from source
qqbot-cron
skill · sliverp/qqbotMIT licenceAudited 20 Oct 2026 · source 151fa9c1620e
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 151fa9c1620e and observed filesystem and network access and no hard-coded secrets. The audit raised 12 findings, 1 critical or high. What it does: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。
Cite
Cite this page
ModelsAtlas. “qqbot-cron (sliverp/qqbot)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/sliverp/qqbot-cron
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Privilege escalation / persistence” in src/utils/platform.ts:403. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemDeclared2 observations
- NetworkDeclared7 observations
- ShellNone observedNo commands run in the source
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 2 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | FAIL | 5 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 5 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (12)
HIGHPrivilege escalation / persistencepriv.escalate · src/utils/platform.ts:403
: "⚠️ ffmpeg 未安装。语音/视频格式转换将受限。安装方式: sudo apt install ffmpeg 或 sudo yum install ffmpeg"
- Why
- asks for elevated privileges
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · bin/qqbot-cli.js:181
console.log(` ${foundInstallation} channels add --channel qqbot --token "…"`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · bin/qqbot-cli.js:206
console.log(` ${cmd} channels add --channel qqbot --token "…"`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathfs.system_paths · src/utils/platform.ts:275
"/usr/local/bin/ffmpeg", // Mac brew
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · package.json
@tencent-connect/qqbot-nodejs, @types/node, tsup, typescript
- Why
- 4 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
INFOInventory / provenanceinv.oversize · docs/images/lighthouse-head.png
docs/images/lighthouse-head.png
- Why
- 1449103 bytes not read
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.md:137
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.md:161
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.zh.md:137
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · CHANGELOG.zh.md:161
curl -fsSL https://raw.githubusercontent.com/tencent-connect/openclaw-qqbot/main/scripts/upgrade-via-npm.sh | bash
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionscope.undeclared_system · <declared scope>
system use found in code, not declared in the description
- Why
- the description does not admit a capability the code has
- Fix
- declare system use in the description, or remove it
Audit 0.4.1 · source sha 151fa9c1620e · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishersliverp GitHub organizationOwner of the repository this skill is read from
- Source foldersliverp/qqbotThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict151fa9c1620eA new audit runs when the source changes
- Repository statusNot archivedLast push 8 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。
---
name: qqbot-channel
description: QQ 频道管理技能(非QQ群)。查询频道列表、子频道、成员、发帖、公告、日程等操作。使用 qqbot_platform_api 工具代理 QQ 开放平台 HTTP 接口,自动处理 Token 鉴权。仅用于 QQ 频道(Guild/Channel)。触发条件:用户提到「频道」「子频道」「guild」「channel」「帖子」「日程」「公告」。
metadata: {"openclaw":{"emoji":"📡","requires":{"config":["channels.qqbot"]}}}
---
# QQ 频道 API 请求指导
> **本 Skill 仅处理 QQ 频道(Guild/Channel)操作。** 频道 ID 为纯数字,API 路径为 `/guilds/...` 和 `/channels/...`。
`qqbot_platform_api` 是 QQ 开放平台统一 HTTP API 网关,**自动填充鉴权 Token**。你只需要指定 HTTP 方法、API 路径、请求体和查询参数即可调用频道相关接口。
---
## 🔀 适用范围(必读)
QQ 频道是类似 Discord 的社区产品,层级结构为 **频道(Guild) → 子频道(Channel)**:
| 层级 | 中文名 | 英文 | API 路径 | ID 格式 |
|------|--------|------|----------|---------|
| 顶层 | 频道 | Guild | `/guilds/{guild_id}` | 纯数字(如 `123456`) |
| 次级 | 子频道 | Channel | `/channels/{channel_id}` | 纯数字(如 `789012`) |
**核心特征**:
- 频道内可以创建多个子频道(文字、语音、论坛、直播等)
- 支持发帖、公告、日程等功能
- 频道成员通过 `/guilds/{guild_id}/members` 管理
- ID 为纯数字格式,API 路径以 `/guilds/` 或 `/channels/` 开头
**触发关键词**:频道、子频道、guild、channel、帖子、日程、公告、论坛、频道成员
## 📚 详细参考文档
每个接口的完整参数说明、返回值结构和枚举值定义:
- `references/api_references.md`
---
## 🔧 工具参数
| 参数 | 类型 | 必填 | 说明 |
|------|------|------|------|
| `method` | string | 是 | HTTP 方法:`GET`, `POST`, `PUT`, `PATCH`, `DELETE` |
| `path` | string | 是 | API 路径(不含域名),如 `/guilds/{guild_id}/channels`,需替换占位符为实际值 |
| `body` | object | 否 | 请求体 JSON(POST/PUT/PATCH 使用) |
| `query` | object | 否 | URL 查询参数键值对,值为字符串类型 |
> 基础 URL:`https://api.sgroup.qq.com`,鉴权头 `Authorization: QQBot {token}` 由工具自动填充。
---
## ⭐ 接口速查
### 频道(Guild)
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取频道列表 | `GET` | `/users/@me/guilds` | query: `before`, `after`, `limit`(最大100) |
| 获取频道 API 权限 | `GET` | `/guilds/{guild_id}/api_permission` | — |
### 子频道(Channel)
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取子频道列表 | `GET` | `/guilds/{guild_id}/channels` | — |
| 获取子频道详情 | `GET` | `/channels/{channel_id}` | — |
| 创建子频道 | `POST` | `/guilds/{guild_id}/channels` | body: `name`\*, `type`\*, `position`\*, `sub_type`, `parent_id`, `private_type`, `private_user_ids`, `speak_permission`, `application_id` |
| 修改子频道 | `PATCH` | `/channels/{channel_id}` | body: `name`, `position`, `parent_id`, `private_type`, `speak_permission`(至少一个) |
| 删除子频道 | `DELETE` | `/channels/{channel_id}` | ⚠️ 不可逆 |
**子频道类型(type)**:`0`=文字, `2`=语音, `4`=分组(position≥2), `10005`=直播, `10006`=应用, `10007`=论坛
### 成员(Member)
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取成员列表 | `GET` | `/guilds/{guild_id}/members` | query: `after`(首次填0), `limit`(1-400) |
| 获取成员详情 | `GET` | `/guilds/{guild_id}/members/{user_id}` | — |
| 获取身份组成员列表 | `GET` | `/guilds/{guild_id}/roles/{role_id}/members` | query: `start_index`(首次填0), `limit`(1-400) |
| 获取在线成员数 | `GET` | `/channels/{channel_id}/online_nums` | — |
### 公告(Announces)
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 创建公告 | `POST` | `/guilds/{guild_id}/announces` | body: `message_id`, `channel_id`, `announces_type`(0=成员,1=欢迎), `recommend_channels`(最多3条) |
| 删除公告 | `DELETE` | `/guilds/{guild_id}/announces/{message_id}` | message_id 设 `all` 删除所有 |
### 论坛(Forum)— 仅私域机器人
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 获取帖子列表 | `GET` | `/channels/{channel_id}/threads` | — |
| 获取帖子详情 | `GET` | `/channels/{channel_id}/threads/{thread_id}` | — |
| 发表帖子 | `PUT` | `/channels/{channel_id}/threads` | body: `title`\*, `content`\*, `format`(1=文本,2=HTML,3=Markdown,4=JSON,默认3) |
| 删除帖子 | `DELETE` | `/channels/{channel_id}/threads/{thread_id}` | ⚠️ 不可逆 |
| 发表评论 | `POST` | `/channels/{channel_id}/threads/{thread_id}/comment` | body: `thread_author`\*, `content`\*, `thread_create_time`, `image` |
### 日程(Schedule)
| 操作 | 方法 | 路径 | 参数说明 |
|------|------|------|----------|
| 创建日程 | `POST` | `/channels/{channel_id}/schedules` | body: `{ schedule: { name*, start_timestamp*, end_timestamp*, jump_channel_id, remind_type } }` |
| 修改日程 | `PATCH` | `/channels/{channel_id}/schedules/{schedule_id}` | body: `{ schedule: { name*, start_timestamp*, end_timestamp*, jump_channel_id, remind_type } }` |
| 删除日程 | `DELETE` | `/channels/{channel_id}/schedules/{schedule_id}` | ⚠️ 不可逆 |
**提醒类型(remind_type)**:`"0"`=不提醒, `"1"`=开始时, `"2"`=5分钟前, `"3"`=15分钟前, `"4"`=30分钟前, `"5"`=60分钟前
> `*` 表示必填参数
---
## 💡 调用示例
### 获取频道列表
```json
{
"method": "GET",
"path": "/users/@me/guilds",
"query": { "limit": "100" }
}
```
### 获取子频道列表
```json
{
"method": "GET",
"path": "/guilds/123456/channels"
}
```
### 创建子频道
```json
{
"method": "POST",
"path": "/guilds/123456/channels",
"body": {
"name": "新频道",
"type": 0,
"position": 1,
"sub_type": 0
}
}
```
### 获取成员列表(分页)
```json
{
"method": "GET",
"path": "/guilds/123456/members",
"query": { "after": "0", "limit": "100" }
}
```
### 发表论坛帖子
```json
{
"method": "PUT",
"path": "/channels/789012/threads",
"body": {
"title": "公告标题",
"content": "# 标题\n\n公告内容",
"format": 3
}
}
```
### 创建日程
```json
{
"method": "POST",
"path": "/channels/456789/schedules",
"body": {
"schedule": {
"name": "周会",
"start_timestamp": "1770733800000",
"end_timestamp": "1770737400000",
"remind_type": "2"
}
}
}
```
### 创建推荐子频道公告
```json
{
"method": "POST",
"path": "/guilds/123456/announces",
"body": {
"announces_type": 0,
"recommend_channels": [
{ "channel_id": "789012", "introduce": "欢迎来到攻略频道" }
]
}
}
```
### 删除所有公告
```json
{
"method": "DELETE",
"path": "/guilds/123456/announces/all"
}
```
---
## 🔄 常用操作流程
### 获取频道和子频道信息
```
1. GET /users/@me/guilds → 获取频道列表,拿到 guild_id
2. GET /guilds/{guild_id}/channels → 获取子频道列表,拿到 channel_id
3. GET /channels/{channel_id} → 获取子频道详情
```
### 论坛发帖 + 评论
```
1. GET /guilds/{guild_id}/channels → 找到论坛子频道(type=10007)
2. PUT /channels/{channel_id}/threads → 发表帖子
3. GET /channels/{channel_id}/threads → 获取帖子列表
4. GET /channels/{channel_id}/threads/{thread_id} → 获取帖子详情(含 author_id)
5. POST /channels/{channel_id}/threads/{thread_id}/comment → 发表评论
```
### 成员管理
```
1. GEExcerpt, first 6,006 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 151fa9c
npm install --omit=dev
git clone https://github.com/sliverp/qqbot git -C qqbot checkout 151fa9c1620e
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 151fa9c1620e only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
151fa9c1620e
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/sliverp/qqbot-cron/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All automation skills →affaan-m/ECC
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing…
n8n-io/n8n
Fetch and display the full transcript from a Loom video URL. Use when the user wants to get or read a Loom transcript.
anthropics/skills
Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it…
Add this badge to your README
[](https://modelsatlas.com/skills/sliverp/qqbot-cron/)
<a href="https://modelsatlas.com/skills/sliverp/qqbot-cron/"><img src="https://modelsatlas.com/skills/sliverp/qqbot-cron/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about qqbot-cron
What does the qqbot-cron skill do?
Is qqbot-cron safe to install?
What can qqbot-cron access on my machine?
Which assistants does qqbot-cron work with?
How current is this page?
Sources
- github.com/sliverp/qqbot — the audited source at commit 151fa9c1620e and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the qqbot-cron skill do?
- Is qqbot-cron safe to install?
- What can qqbot-cron access on my machine?