Create one-shot

[Knovek]

one shot clan plugin
contains integration with hiscores, wiseoldman and cloudflare for discord webhooks
main functions are clan rankings on hiscores, discord embeds with new collection logs, achievements, etc, and mod tools for clan management

[runelite-github-app]

New plugin one-shot: https://github.com/Knovek/runelite-one-shot/tree/d43cddc4775bc804189678140546d9728f9031e0

[runelite-github-app]

This plugin requires a review from a Plugin Hub maintainer. The reviewer will request any additional changes if needed.

---

Internal use only: Reviewer details Maintainer details

[tylerwgrass]

Not a full review but:
1/ you include functionality that supports scouting targets which is not allowed (please review https://secure.runescape.com/m=news/third-party-client-guidelines?oldschool=1)
2/ there are many existing plugins that support logging to a discord webhook (such as dink), is there a reason you cannot use these? while it's not required we do recommend using these instead.

[Knovek]

Regarding dink plugin, we're not using it for a few reasons

• want to have more control on which achievements get broadcasted
• i can check the username and clan name to confirm that no one is abusing our webhooks easily
• i can avoid people having to copy-paste several different webhooks into the config panels, so we can host them in a cloud instead

Regarding the scouting feature, i'm not sure if it's breaking terms
The plugin is getting only nearby players that are within drawing distance and checking their username in normal hiscores vs hardcore hiscores, this is purely for us to know if there's a hcim that we can try to recruit to our clan chat
if it's not allowed, are there any restrictions we can induce in the plugin to still have some of its functionality active?

[Felanbird]

want to have more control on which achievements get broadcasted

Dink supports this

i can check the username and clan name to confirm that no one is abusing our webhooks easily

Dink supports this

i can avoid people having to copy-paste several different webhooks into the config panels, so we can host them in a cloud instead

Dink supports this

[tylerwgrass]

Regarding the scouting feature, i'm not sure if it's breaking terms

There are ways for this feature to be abused outside of your intended use case.

[Knovek]

Hi,
I’ve been looking more into Dink to understand its limitations compared to what I’m trying to achieve, so please correct me if I’ve misunderstood anything.

For death notifications, Dink provides a toggle for safe deaths, but in my case I only want to send a notification when a player actually loses their HCIM status. The only reliable way I’ve found is to save a screenshot for every death (keeping only the most recent one), and send that screenshot only when the HCIM varbit changes, since as far as I know, that varbit is triggered only when the player is sent to Death’s Office.

If I was to implement dink with their external plugin messaging, I’m not sure whether it’s possible to send my own screenshot payload rather than having Dink capture a screenshot at the moment the event fires. I’m also unsure whether it would be possible to include the player’s clan rank icon as the embed author image, like in the example below:

Regarding the scouting portion of the plugin:
All I am displaying is a list of HCIM names and their total levels. Would this be acceptable for Plugin Hub approval if I ensure the feature is automatically disabled in all PvP-related areas (e.g., PvP worlds, Ferox Enclave, Mage Bank, the Wilderness, Edgeville, etc.)?

Thank you for your time and clarification!

[Felanbird]

https://github.com/pajlads/DinkPlugin/blob/master/docs/json-examples.md

[Knovek]

@Felanbird
Thanks for sharing the link, I’ve reviewed both the JSON examples and the external plugin messaging documentation.
From what I can see, while Dink does support structured webhook output and allows external plugins to request that Dink emit messages, this still doesn’t address the core differences I outlined:

HCIM status loss vs. generic death events
Dink’s death notifications are still driven by death events. There is no documented support for triggering notifications based on a varbit change (e.g., HCIM status loss upon being sent to Death’s Office), which is the specific condition I need to detect.

Custom screenshot timing and payloads
Dink can attach screenshots to its own notification events, but the external plugin messaging interface does not document a way to supply a custom screenshot captured at a different time. The JSON examples show Dink’s output format, not a mechanism for injecting externally captured images.

Custom embed metadata (e.g., clan rank icons)
While Dink provides rich embeds, the documentation does not indicate support for overriding or extending embed author images or metadata beyond Dink’s predefined schema via external plugin messaging.

Centralized webhook handling and abuse prevention
Although Dink supports webhook configuration, the model still assumes client-side configuration. Our approach intentionally decentralizes webhook handling to reduce user setup and allow additional validation, while keeping the webhooks outside of runelite to avoid leaks.

Because of these limitations, the linked documentation doesn’t demonstrate how Dink can be used to achieve the same behavior without either changing the requirements or re-implementing significant logic outside of Dink.
If there is a supported way to trigger notifications on HCIM varbit changes, provide custom screenshots, or supply extended embed metadata through Dink’s external messaging that I’ve missed, I’m happy to adjust the implementation. Otherwise, I don’t believe this plugin is functionally duplicating Dink in its current form, neither trying to replace it.

I’m very open to making changes if there are specific policy or technical constraints that need to be met, I just need clarity on what those are.

@tylerwgrass
I'm still waiting for feedback regarding this topic.

Regarding the scouting portion of the plugin: All I am displaying is a list of HCIM names and their total levels. Would this be acceptable for Plugin Hub approval if I ensure the feature is automatically disabled in all PvP-related areas (e.g., PvP worlds, Ferox Enclave, Mage Bank, the Wilderness, Edgeville, etc.)?

Thank you in advance

[tylerwgrass]

Leaving edge cases will make it much harder for us to verify that it can't be used for scouting than just having it removed.

You should assume that anyone who installs this would have access to all the features. From a non-rules enforcement perspective, you would kinda be shooting yourself in the foot by allowing any player to easily find HCIMs.

[riktenx]

It's as @tylerwgrass said above, there's no reasonable restriction on this functionality that we can enforce because edge cases will always be abusable (e.g., if you disable wilderness, people will just park at the ditch and scout HCIMs going in) or Jagex will add new content that the restrictions don't immediately cover etc.

As submitted we cannot accept this due to the scouting feature. If you are not willing to remove the scouting feature we will need to close this PR.

[Knovek]

It's as @tylerwgrass said above, there's no reasonable restriction on this functionality that we can enforce because edge cases will always be abusable (e.g., if you disable wilderness, people will just park at the ditch and scout HCIMs going in) or Jagex will add new content that the restrictions don't immediately cover etc.

As submitted we cannot accept this due to the scouting feature. If you are not willing to remove the scouting feature we will need to close this PR.

will remove it then, thanks for reply

[Knovek]

@tylerwgrass @riktenx
As discussed, I’ve removed the scouting functionality from the plugin.
Please let me know if this resolves the concern or if any further changes are needed.

[Adam-]

This plugin uses reflection, which is not permitted on the pluginhub. Please remove your use of reflection.

[Knovek]

@Adam-
Thanks for pointing this out.

I’ve removed all direct uses of java.lang.reflect.* from the plugin and reviewed the codebase to ensure no reflection is being used. The only remaining reflect import is com.google.gson.reflect.TypeToken, which is used solely for JSON deserialization via Gson and does not involve runtime reflection against RuneLite or client internals.

If there’s a specific class, method, or commit that still appears to use reflection, I’d really appreciate a pointer so I can address it promptly.
Thanks again for the review.

[Knovek]

Hello, is there anything else I need to modify?