[GuangxiZheng]

Plugin Submission

Plugin information

• Author: shineos
• Plugin name: line-message-sender (LINE Message Sender)
• Version: 0.1.0
• Source repository: https://github.com/Shineos/dify-line-message-sender
• Contact: koushaku.tei@shineos.com

Submission type

• New plugin
• Version update

What changed

Adds LINE Message Sender, a tool plugin that sends push and broadcast messages to LINE users and groups from Dify workflows via the LINE Messaging API.

It includes four tools: Send Push Message (to a user, group or room), Send Broadcast Message (to all friends of the configured LINE Official Account), Get User Profile and Get Bot Info. The user configures their own long-lived LINE channel access token as provider credentials; every send happens in the configured LINE Official Account.

This PR adds only shineos/line-message-sender/line-message-sender-0.1.0.difypkg. The source corresponding to the package is commit d638e63659c272959dbd6144a256f52ff489cd2a in the public source repository.

Risk level

• Low risk
• Medium risk
• High risk

Medium risk is selected because the plugin performs write actions in a third-party service: it sends messages to LINE users, groups, rooms and followers on behalf of the configured LINE Official Account, using the channel access token supplied by the user. The plugin does not execute commands or code, run SQL, access databases or the filesystem, automate browsers, or handle highly sensitive personal data.

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Development Guidelines.
• I tested this plugin on Dify Community Edition (self-hosted v1.18.0), including an end-to-end workflow run (Get Bot Info and a real broadcast delivery), and documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, access tokens, private keys, certificates with private material, or cloud credentials.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md or a hosted privacy policy, and manifest.yaml references it.
• All user-facing text is primarily in English, with any localized README files following the i18n guidance.

Security and privacy notes

• User content: the message text and recipient IDs provided by the workflow are sent to https://api.line.me to perform the requested send or lookup. The channel access token is stored as an encrypted provider credential in the Dify workspace and is sent only to the approved LINE API endpoint.
• External destinations: the only destination is https://api.line.me, declared in manifest.yaml network.domains. Requests use HTTPS with 15-30 second timeouts.
• No secrets in the package: the package and source repository contain no tokens or credentials. PRIVACY.md documents recipients, storage and the absence of telemetry.
• Error handling: LINE API errors are surfaced with their messages; credentials and URLs are not leaked in error text.
• Offline tests: the repository includes an offline pytest suite (python -m pytest tests -q, 7 tests) covering provider validation and all four tools with mocked HTTP.

Local validation

Validated the final package with the unmodified official langgenius/dify-marketplace-toolkit at commit 57a21d1304b1108df3e6b90a15a4f5dd9f0915f9 on macOS (Python 3.12, yq 4.54.1).

Command used:

python toolkit/validator/validate-difypkg.py line-message-sender.difypkg --output-dir /tmp/validation-reports2

Results:

• Exit code: 0.
• Blocking failures: 0.
• Environment/check execution failures: 0.
• All blocking checks passed (package contents, secrets, binaries, manifest metadata incl. repo/contact, README metadata, version, dependencies, install, packaging, python compile, prohibited financial activity).
• Dependency set is fully pinned (dify-plugin==0.9.1); no known vulnerabilities in the pinned dependency set.
• Warning categories: 1 (access_domains): the static scanner reports that all 5 outbound call sites build the request URL at runtime from a constant base (https://api.line.me), which cannot be extracted statically; the domain is declared in manifest.yaml network.domains.
• Package SHA-256: 7c0eb205ae02649f3d8b4e1de4fb00b74ff638b17a01a8762bb1190948c53b81.

Limitations

• Tested on Dify Community Edition (self-hosted v1.18.0), including a successful end-to-end workflow run with a real LINE broadcast delivery. Dify Cloud was not tested because the plugin is currently distributed from this submission only.
• Broadcast messages count toward the user's LINE plan monthly quota; push delivery requires the recipient to be a friend of the bot. These are LINE service constraints, documented in the README.
• Dify-side note (not a plugin defect): on self-hosted Dify 1.16-1.18, workflow tool nodes imported via DSL must use provider_type: "builtin"; nodes written as "plugin" receive empty credentials in this Dify version. The UI writes the correct value automatically, and the plugin README documents this for DSL users.