a

• Outcome: Review
• Latest audit: Sep 8, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

The skill largely does what it says, but it should be reviewed because it searches sensitive DingTalk data and its command examples pass user text into CLI calls without explicit safe argument handling.

Install only in an environment where dws access is already governed by DingTalk permissions and users are authorized to search the requested people, messages, mail, documents, and activity records. Agents using this skill should pass CLI arguments through structured argv-style execution or strict escaping, ask for narrower scope before broad behavior searches, and avoid using it for non-work-related employee lookup or communication profiling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42
• Finding: Shell Command Injection Through Verbatim User-Input Interpolation<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 42-43, 54, 63, and 70 - `references/lite-recipes.md`, lines 16 and 29 **Vulnerability Type**: Unsafely constructed shell commands **Risk Level**: Medium ### Complete Vulnerable Snippets `SKILL.md`, lines 42-43: ```text `--query` must preserve the complete original user input without truncation or modification. dws aisearch person --query "<complete value>" --dimension <dimension> --format json ``` `SKILL.md`, line 54: ```shell dws aisearch enterprise --queries "<topic>" --types <document,mail,...> --time-range "<time>" --format json ``` `SKILL.md`, line 63: ```shell dws aisearch behavior --queries "<topic>" --behavior-type <action> --direction <direction> --format json ``` `references/lite-recipes.md`, line 16: ```shell aisearch person --query "<keyword>" --dimension <dimension> ``` `references/lite-recipes.md`, line 29: ```shell contact user search-mobile --mobile "<mobile number>" aisearch person --query "<keyword>" --dimension <dimension> ``` ### Technical Analysis The Skill instructs the agent to place user-controlled names, topics, mobile numbers, time ranges, and interaction directions directly into shell-style command templates. It also requires some values to be preserved verbatim. No corresponding requirement mandates structured argument passing, shell escaping, validation, or rejection of shell metacharacters. Double quotes alone do not safely neutralize shell input. If these generated command strings are passed to a shell, input containing a quote followed by shell operators can escape the intended argument. Command substitutions such as `$()` and backticks may also be evaluated inside double quotes by common shells. For example, a malicious search value could conceptually close the quoted argument, append an unintended command, and comment out the remainder. The exact syntax would depend on the shell and execution interface. The issue is exploitable only when th ...[truncated 1689 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Invoke `dws` through a process API that accepts an executable and an argument array. Each user-controlled value must be passed as a separate argument without invoking a shell. 2. Explicitly prohibit execution through `sh -c`, `bash -c`, `eval`, command substitution, or equivalent string-evaluation mechanisms. 3. Validate fixed-choice parameters against strict allowlists: - `dimension`: documented dimension values only. - `types`: documented content-type values only. - `behavior-type`: documented behavior values only. 4. Treat names, topics, time ranges, directions, and mobile numbers as opaque data rather than command text. 5. If shell execution is unavoidable, use robust platform-specific argument escaping and reject line breaks, unmatched quotes, shell operators, backticks, and command-substitution syntax. 6. Validate exact mobile-number searches against the expected telephone-number format before execution. 7. Add tests using values containing quotes, semicolons, pipes, newlines, backticks, `$()`, redirections, and option-like prefixes to verify that every value remains one literal argument. 8. Update both the primary Skill instructions and the lightweight recipes so that safe structured execution is mandatory and consistent. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill explicitly enables searching enterprise behavior records, including messages, emails, creation, sharing, editing, and receipt history, which are highly privacy-sensitive metadata and may expose confidential work patterns or communications. The documentation contains no guardrails around authorization, purpose limitation, consent, auditing, or minimization, so an agent could over-collect or disclose internal activity data to an unauthorized requester.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The person-search capability supports internal personnel discovery across dimensions such as department, duties, supervisor/subordinate relationships, job number, and phone-related clues, which can expose sensitive employee directory data and facilitate profiling or targeting. Because the skill lacks warnings or restrictions on handling personal data, an agent may disclose employee information too broadly or use phone clues for unintended identity resolution.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The enterprise-search examples are broad enough to capture common user requests like searching messages or emails without clearly constraining source, scope, or consent boundaries. In a cross-source search skill, this ambiguity can cause the agent to invoke a wider retrieval surface than the user intended, increasing the chance of unnecessary access to sensitive corporate content.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The behavior-search triggers include highly ambiguous requests such as 'what did I do today' or 'messages/emails/documents I sent to someone,' but they do not clearly bound actor, direction, data source, or time scope. Because behavior search reconstructs user activity across systems, weak activation constraints can lead to over-collection or disclosure of sensitive behavioral records beyond the minimum needed for the request.

Static analysis

No suspicious patterns detected.