ClawHub
Back to skill

Security audit

钉钉闪记数据提取

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for accessing DingTalk meeting records, but it needs Review because it directs unverified software installation and documents write actions beyond its extraction-focused purpose.

Install only if you trust the DingTalk CLI publisher and are comfortable reviewing the setup path. Prefer installing a pinned, verified CLI version outside the skill, avoid pipe-to-shell or Invoke-Expression installers, confirm before any update/upload command, and treat retrieved meeting transcripts and summaries as confidential data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/dws_helper.sh:56
Finding

Unverified Mutable Remote Installers Are Executed Directly

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:33
  • SKILL.md:39
  • README.md:31
  • scripts/dws_helper.sh:56

Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Code Snippets:

SKILL.md:33 and README.md:31:

bash
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

SKILL.md:39:

powershell
irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex

scripts/dws_helper.sh:55-59:

bash
info "Using sh script installation..."
if curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh; then
    info "sh script installation succeeded"
    return 0

Technical Analysis

These installation methods retrieve scripts from the mutable main branch of an external GitHub repository and pass their contents directly to a command interpreter. The downloaded content is not pinned to a reviewed commit or release and is not checked against a cryptographic digest or publisher signature.

The effective code executed by the Skill can therefore change after this project has been reviewed. The external installer is not included in the audited artifact, so its current or future actions cannot be established from the local source. HTTPS protects transport integrity but does not protect against compromise of the upstream repository, maintainer account, or release process.

Direct execution is not required for the declared functionality of retrieving DingTalk meeting records. A separately downloaded and verified installer or a pinned package can provide the same functionality without giving a mutable upstream branch immediate code-execution authority.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capabl ...[truncated 1204 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all direct curl | sh and irm | iex installation instructions and execution paths.
  2. Pin the installer to a reviewed release or immutable commit rather than the mutable main branch.
  3. Download the installer to a local file without executing it:
    bash
    curl -fL -o install.sh "PINNED_RELEASE_URL"
  4. Verify the file using a trusted publisher signature or a SHA-256 digest distributed through an independent trusted channel:
    bash
    echo "EXPECTED_SHA256  install.sh" | sha256sum -c -
  5. Inspect the downloaded script and execute it only after verification:
    bash
    sh install.sh
  6. Apply equivalent download, signature verification, and separate execution controls on Windows instead of using Invoke-Expression.
  7. Run installation as an unprivileged account and document any filesystem permissions the installer actually requires.
  8. Prefer a pinned, provenance-verified package installation over a remotely hosted installation script.

T08 · Insecure Dependencies

Warning
Location
scripts/dws_helper.sh:44
Finding

Unpinned Global npm Package Installation Exposes a Supply-Chain Execution Path

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:24
  • README.md:26
  • scripts/dws_helper.sh:44

Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippets:

SKILL.md:24 and README.md:26:

bash
npm install -g dingtalk-workspace-cli

scripts/dws_helper.sh:41-48:

bash
if command -v npm &> /dev/null; then
    info "Using npm installation..."
    if npm install -g dingtalk-workspace-cli; then
        info "npm installation succeeded"
        return 0
    else
        warn "npm installation failed; trying sh script installation..."
    fi

Technical Analysis

The command installs whichever package version npm resolves as current at execution time. No exact version, lockfile, integrity value, package provenance requirement, or publisher signature is specified.

npm packages can execute lifecycle scripts during installation. Consequently, a malicious or compromised future release could execute code before the dws command is used. The -g option installs the package globally, increasing the scope of modified files and making the resulting executable available broadly in the user's command environment.

The package name is consistent across the project, and the audit found no evidence of typosquatting in the local files. The risk arises from trusting an unpinned future package state and installing it globally rather than from a confirmed malicious package payload.

Attack Path

  1. An attacker compromises the npm publisher account or package release process for dingtalk-workspace-cli.
  2. The attacker publishes a malicious version or adds a malicious npm lifecycle script.
  3. A user or agent runs the documented installation command or invokes scripts/dws_helper.sh install.
  4. npm resolves the unpinned dependency to the malicious release.
  5. npm executes package lifecycle code during installatio ...[truncated 778 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin dingtalk-workspace-cli to a specific reviewed version:
    bash
    npm install --save-exact dingtalk-workspace-cli@REVIEWED_VERSION
  2. Prefer project-local installation over -g, and invoke the pinned binary from the local dependency directory.
  3. Commit and enforce a lockfile containing npm integrity metadata.
  4. Verify npm provenance and publisher identity before approving version updates.
  5. Review package contents and lifecycle scripts before upgrading.
  6. In controlled deployments, install with lifecycle scripts disabled when they are not required:
    bash
    npm install --ignore-scripts
  7. Perform installation without root or administrator privileges and restrict access to DingTalk credentials during dependency installation.
  8. Use an approved internal registry or artifact mirror that admits only reviewed package versions.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping curl output directly into sh removes any opportunity to inspect the downloaded content before execution and is a classic command-chaining anti-pattern. In the context of a skill README, this is more dangerous because users may copy-paste it verbatim, leading to immediate remote code execution if the fetched content is malicious or altered.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

或 sh 脚本安装：

bash
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

3. 登录认证

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The curl ... | sh pattern is a classic chaining-abuse sink because it combines remote retrieval with immediate execution in one step, preventing meaningful inspection and making arbitrary command execution trivial if the upstream content is malicious. In an agent skill context, this is especially risky because the skill may normalize or automate dangerous execution behavior on endpoints handling enterprise data.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

macOS / Linux：

bash
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

Windows (PowerShell)：

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script downloads a remote shell script from GitHub and pipes it directly into sh, giving the remote content immediate code execution on the host. If the upstream repository, network path, or referenced branch is compromised, an attacker can run arbitrary commands with the privileges of the skill process.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README encourages extraction of meeting recordings, transcripts, summaries, and todos, all of which are likely to contain sensitive business or personal information, but provides no warning about privacy, retention, or access control. In a data-extraction skill, omission of handling guidance increases the risk of unintentional exposure or misuse of confidential content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill is described as extraction-only, but the README documents mutation commands such as updating titles/summaries, replacing text, and creating mind maps. This expands the apparent capability boundary and can lead an agent or user to perform state-changing actions on DingTalk data when they expected read-only behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example explicitly redirects transcript output to a local file, which can persist sensitive meeting content on disk without encryption, access controls, or user warning. This is especially risky because transcripts often contain confidential discussions, PII, or regulated data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly instructs use of shell commands, including installation and authentication steps, but does not declare any tool scope or allowed-tools boundary. That mismatch weakens reviewability and containment, making it easier for an agent to execute commands beyond what users may expect from a data-extraction skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill accesses highly sensitive meeting artifacts such as transcripts, summaries, attendees, and todos, yet it does not prominently warn about confidentiality, retention, or downstream handling risks. In enterprise contexts, these records may contain internal strategy, PII, customer data, or regulated content, so insufficient privacy framing increases the chance of inappropriate access or disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

For a skill whose stated purpose is data extraction, providing remote installation script execution materially increases the attack surface and exceeds the minimum capability needed for safe operation. This creates a path for arbitrary code execution via fetched installer content, especially if the source is compromised or the user cannot inspect what is run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions recommend piping remote content directly into a shell or PowerShell interpreter without an explicit warning, verification step, or integrity check. This is dangerous because it trains users and agents to execute unreviewed network-fetched code, which can lead to full host compromise if the source or transport is abused.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata and description present the capability as extracting meeting data, but the documented commands also support updating titles, updating summaries, replacing transcript text, creating mind maps, and uploading recordings. This scope expansion can mislead users and downstream agents into authorizing write operations when they expected read-only access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script includes package installation and environment modification logic even though the skill is described as a data-extraction helper for DingTalk minutes. This expands the skill's privilege and attack surface from read-only data access to arbitrary software installation, which could execute untrusted code and persist changes on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Running npm install -g modifies the global host environment and executes package lifecycle scripts, which may run arbitrary code during installation. This is disproportionate to the stated purpose of reading DingTalk minutes and creates supply-chain and persistence risks if the package or dependencies are malicious or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script fetches and executes remote code without any integrity validation or meaningful user warning, so users may trigger code execution believing they are only enabling a read-only helper. In this skill context, that mismatch makes the behavior more dangerous because the declared functionality does not justify arbitrary remote execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

All user-facing instructions in this file are Chinese-only, which can amount to a language/locale policy issue when no opt-in, alternative language, or justification is provided. The document links to a Chinese document as well, but does not indicate that the skill is intentionally region-specific or offer multilingual access in the README itself.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The README instructs users to fetch and execute a remote shell script directly from GitHub. This creates a supply-chain and integrity risk: if the script source, repository, branch, network path, or upstream account is compromised, arbitrary code will execute immediately on the user’s system.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

或 sh 脚本安装：

bash
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

3. 登录认证

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The skill fetches an external script from GitHub at runtime, introducing trust in mutable remote content outside the reviewed skill file. Even if the repository is legitimate, compromise, force-pushes, or dependency-chain manipulation could turn this into arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

macOS / Linux：

bash
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

Windows (PowerShell)：

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Fetching an external script and executing it directly introduces a classic supply-chain execution path. Because this skill is supposed to extract meeting data, not administer the host, the context increases risk: a user or operator may not expect that invoking the skill can execute arbitrary third-party shell code.

Content

Scanner excerpt · scripts/dws_helper.sh (reported line 56)May include surrounding context.

sh
# 方式2：使用 sh 脚本安装
    info "使用 sh 脚本安装..."
    if curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh; then
        info "sh 脚本安装成功"
        return 0
    else