Security audit

Dataworks Smart Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DataWorks monitoring helper, but it needs review because it handles cloud credentials and may send sensitive failure-log details to LLM and Feishu destinations without strong safeguards.

Install only if you are comfortable with a monitoring agent reading DataWorks task metadata and failure logs. Use a least-privilege read-only identity, store secrets in environment variables or a secret manager rather than TOOLS.md or source files, redact and truncate logs before LLM or Feishu use, approve the Feishu destination and channel membership, and avoid enabling cron until the data flow is reviewed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:76
Finding: Unsafe Guidance for Storing Long-Lived Cloud Credentials in Source Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:53
Finding: Potential Disclosure of Sensitive DataWorks Logs Through LLM Processing and Feishu Reporting
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to place access key ID and secret directly into a script, which normalizes hardcoded credential handling and increases the likelihood that real secrets will be committed to source control or exposed in shared environments. In a monitoring skill that accesses DataWorks project data, leaked credentials could allow unauthorized API access and broader compromise of project resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README recommends sending monitoring results to a Feishu webhook without warning that operational data, failure details, and possibly sensitive task metadata will be transmitted to an external service. This can cause unintended data disclosure, especially if alerts include job names, error messages, internal identifiers, or infrastructure details.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The documented example performs an outbound HTTP POST to a Feishu webhook, creating an external transmission path for monitoring content. In this skill's context, alerts may contain internal project names, failure diagnostics, and operational metadata, so the transmission is security-relevant even though it is presented as an optional integration example.
Content: Scanner excerpt · README.md (reported line 94)May include surrounding context.
def send_feishu_notification(text): webhook_url = "https://open.feishu.cn/open-apis/bot/v2/hook/xxx" requests.post(webhook_url, json={"msg_type": "text", "content": {"text": text}})

text
## 📊 示例输出

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that failure logs are analyzed by an LLM, but it does not clearly warn users that raw or partially raw log contents may be shared with an AI model. Error logs often contain secrets, identifiers, SQL fragments, endpoints, and other sensitive operational data, so undisclosed model exposure creates a real confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly sends detailed monitoring reports and alerts to Feishu, but it does not present a clear user-facing disclosure or consent step before transmitting potentially sensitive operational data to an external messaging platform. Because the reports are derived from task status and error details, this can expose internal system metadata or incident information beyond the immediate chat context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: All user-facing instructions and examples are presented only in Chinese, which effectively imposes a language choice without opt-in. Under the stated policy, language-specific behavior should either offer a choice or clearly document a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description and the rest of the skill instructions are entirely in Chinese, and the examples, triggers, and notifications assume Chinese output. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue unless a justified regional constraint is documented.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.