ClawHub
Back to skill

Security audit

a

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk search skill is mostly coherent, but it should be reviewed because it combines sensitive enterprise search with shell-style command templates that do not define safe handling for user-supplied arguments.

Install only in environments where dws access is already permissioned for the user and enterprise policy allows these searches. Agents using this skill should pass all user-derived values as literal CLI arguments, not by building shell command strings, and should limit searches involving people, phone clues, mail, messages, or behavior history to authorized business needs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:41
Finding

Shell Command Injection Through Unescaped User-Controlled Search Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:41, SKILL.md:50, SKILL.md:59; additional affected examples appear in references/aisearch.md:21-27,145-156,212-220 and references/lite-recipes.md:13-14,27-30
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable command templates:

shell
dws aisearch person --query "<complete value>" --dimension <dimension> --format json
dws aisearch enterprise --queries "<topic>" --types <document,mail,...> --time-range "<time>" --format json
dws aisearch behavior --queries "<topic>" --behavior-type <action> --direction <direction> --format json

The documentation also requires the search target to be passed through verbatim rather than truncated or modified. Consequently, malicious shell syntax contained in a user-provided name, employee number, telephone clue, department, topic, time range, direction, or other argument may reach the command execution layer unchanged.

Technical Analysis

The command templates place user-controlled values inside shell-style double quotes. Double quotes prevent ordinary word splitting but do not disable shell command substitution. Constructs such as $(command) and backtick substitutions are evaluated by POSIX-compatible shells before the dws process starts.

For example, if a user supplies the following search value:

text
$(attacker-command)

the generated command can be equivalent to:

shell
dws aisearch person --query "$(attacker-command)" --dimension name --format json

If the agent's execution tool passes this string through a shell, attacker-command executes locally and its output becomes the value of the --query argument. Merely surrounding the value with double quotes therefore does not provide shell-safe escaping.

Exploitability depends on the downstream execution mechanism. A structured process API that passes an argume ...[truncated 1731 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require execution through a structured process API that accepts an executable and argument array, for example an equivalent of:

    text
    executable: dws
arguments: ["aisearch", "person", "--query", userValue, "--dimension", validatedDimension, "--format", "json"]

    The command must not be joined into a shell command string.

  2. Explicitly prohibit execution through sh -c, bash -c, PowerShell string evaluation, or similar shell-evaluation interfaces.

  3. If shell execution is unavoidable, apply a well-tested, platform-specific shell-quoting routine to every user-derived argument. Do not rely on double quotes or ad hoc character replacement.

  4. Validate fixed-choice fields against strict allowlists:

    • Person dimensions: all, name, department, position, duty, supervisor, subordinate, phone, and jobNumber.
    • Content types: only the documented type identifiers.
    • Behavior types: all, send, create, share, edit, and receive.

  5. Treat search text, time ranges, chat scopes, and directions as opaque argument values. They should never be interpreted as executable syntax.

  6. Add adversarial tests covering command substitutions, backticks, quotes, semicolons, newlines, redirection operators, pipes, and platform-specific metacharacters. Verify that each value reaches dws as one literal argument without causing a secondary process to execute.

  7. Update every command example in SKILL.md, references/aisearch.md, and references/lite-recipes.md to state that the displayed shell syntax is illustrative and that implementations must use argument-vector execution.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly enables semantic search across internal personnel data, enterprise knowledge, and user behavior records, including phone clues, emails, messages, and 'who sent/received what'. Without any user-facing privacy warning, authorization boundary note, or guidance to minimize sensitive queries, the documentation normalizes access to highly sensitive internal data and increases the risk of over-collection, misuse, or disclosure by downstream agents and users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s operational instructions and user-facing guidance are entirely in Chinese, which can force a specific language on users without opt-in. The policy for this audit flags language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Line L15 includes the trigger example "translate this" alongside Chinese examples, which suggests the skill may privilege or assume a specific language in its invocation guidance. The file does not state that users may use their preferred language or that the English phrasing is only illustrative, so this can be interpreted as a language-policy issue under the natural-language policy rule.

Content

No source excerpt is available for this finding.