dingtalk-docs

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:20 AM UTC
• Version: 0.3.4

Overview

The skill is mostly a disclosed DingTalk document helper, but it needs review because it can modify cloud documents and its scope conflicts over multidimensional tables and broad node creation.

Install only if you are comfortable granting this skill access to a token-bearing DingTalk document service and allowing it to create or overwrite cloud document content. Review ambiguous table or multidimensional-table requests carefully, pin and verify mcporter before global installation, and avoid importing local files unless you have checked their contents and destination.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:45

Finding

Unpinned Global Installation of a Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Locations: README.md:45-48, package.json:31-33
Vulnerability Type: Supply-chain exposure through an unpinned globally installed dependency
Risk Level: Medium

Relevant code from README.md:45-48:

bash

### 2. Install dependencies

npm install -g mcporter

Relevant code from package.json:31-33:

json

"peerDependencies": {
  "mcporter": ">=0.7.0"
},

Technical Analysis

The installation instructions globally install mcporter without specifying an exact reviewed version. The package metadata reinforces this behavior by accepting every release equal to or newer than version 0.7.0.

As a result, installation behavior is not reproducible and may change after this Skill has been reviewed. A future package release can introduce new code or npm lifecycle scripts that execute during installation. Because the documented command uses global installation, such scripts execute with the permissions of the user running npm and can modify that user's global package environment.

The project does not include a lockfile or integrity value that would constrain this global installation to a reviewed artifact. No evidence was found that the current mcporter package is malicious; the vulnerability is the uncontrolled trust placed in future accepted releases.

Attack Path

1. An attacker compromises the upstream mcporter package, its publisher account, or its release process.
2. The attacker publishes a malicious version satisfying the >=0.7.0 range.
3. A user follows the documented npm install -g mcporter command.
4. npm resolves and downloads the malicious accepted release rather than a previously reviewed version.
5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
6. The package can then alter user-accessible files, inspect user-accessible data or environment variables, or compromise later `mcpor ...[truncated 741 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended installation command with an exact, reviewed version:

   bash

   npm install --global mcporter@0.7.0
   

   The selected version should be updated only after review and testing.

2. Change the dependency declaration from an unrestricted lower-bound range to an exact version where platform compatibility permits:

   json

   "peerDependencies": {
     "mcporter": "0.7.0"
   }
   

3. Prefer a project-local dependency over global installation, and commit a lockfile generated by the supported npm version.

4. Use npm lockfile integrity metadata or an equivalent artifact-verification mechanism to ensure the downloaded package matches the reviewed release.

5. Document the expected npm registry and publisher identity so users can detect dependency-confusion or registry-substitution scenarios.

6. Install dependencies using an unprivileged account and avoid sudo npm install -g.

7. Review package lifecycle scripts and release changes before updating the pinned version. Where operationally feasible, install with lifecycle scripts disabled and explicitly enable only scripts demonstrated to be required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The manifest presents the skill as managing DingTalk cloud documents, but the body also describes exporting cloud content to local Markdown files and importing local workspace files into DingTalk. That mismatch can cause users or orchestration systems to invoke the skill in contexts where local filesystem access and data exfiltration were not expected, increasing the chance of sensitive data being copied between trust boundaries. The contradiction is especially risky because the extra behavior is operational, not merely descriptive.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/TEST_REPORT.md (reported line 21)May include surrounding context.

md

| 用例 | 说明 | 结果 |
|------|------|------|
| 目录遍历攻击 | `../etc/passwd` → 应拒绝 | ✅ |
| 绝对路径越界 | `/etc/passwd` → 应拒绝 | ✅ |
| 合法相对路径 | 工作目录内文件 → 应通过 | ✅ |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/TEST_REPORT.md (reported line 22)May include surrounding context.

md

| 用例 | 说明 | 结果 |
|------|------|------|
| 目录遍历攻击 | `../etc/passwd` → 应拒绝 | ✅ |
| 绝对路径越界 | `/etc/passwd` → 应拒绝 | ✅ |
| 合法相对路径 | 工作目录内文件 → 应通过 | ✅ |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 34)May include surrounding context.

python

| 用例 | 说明 | 结果 |
|------|------|------|
| 目录遍历攻击 | `../etc/passwd` → 应拒绝 | ✅ |
| 绝对路径越界 | `/etc/passwd` → 应拒绝 | ✅ |
| 合法相对路径 | 工作目录内文件 → 应通过 | ✅ |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_security.py (reported line 47)May include surrounding context.

python

| 用例 | 说明 | 结果 |
|------|------|------|
| 目录遍历攻击 | `../etc/passwd` → 应拒绝 | ✅ |
| 绝对路径越界 | `/etc/passwd` → 应拒绝 | ✅ |
| 合法相对路径 | 工作目录内文件 → 应通过 | ✅ |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file contains user-facing natural-language content in Chinese, and multiple entries describe the skill documentation and intent handling as using Chinese natural language. Under the policy rule, forcing a specific language without opt-in can be a locale-policy violation when no alternative or choice is documented in the file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The changelog explicitly states that import/export operations will read from and write to workspace-local files, while the skill metadata describes only cloud-document management. This scope mismatch can mislead reviewers and users about the skill's actual data flows, increasing the risk of unexpected local file access and exfiltration pathways if the skill is invoked under the assumption it only touches DingTalk cloud content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Advertising import of local files into DingTalk documents introduces local file ingestion beyond the declared cloud-document scope. That discrepancy is dangerous because it can cause unreviewed workspace files to be uploaded into remote documents, enabling accidental disclosure of local secrets or proprietary data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Advertising export of cloud documents to local files reveals a capability that expands the trust boundary from cloud-only document management to local data egress. When this is absent from the manifest description, users or orchestrators may authorize the skill without understanding that sensitive cloud content can be materialized onto disk, where it may be less controlled or further exposed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill description and usage guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to environment variables and documents local helper scripts that read and write workspace files and invoke a shell tool (mcporter), but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authority/expectation gap: a reviewer or dispatcher may believe this is only a cloud-document skill, while the skill can also touch local files and execute tooling. In a skill context, undocumented local I/O and shell access increase the risk of unintended data movement or abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill should not trigger for multidimensional-table operations, yet the documented behavior explicitly supports creating 多维表 via create_dentry_under_node(accessType="7"). This inconsistency can lead the wrong skill to handle a request, causing unexpected creation or modification of a different DingTalk resource type than the user or router intended. In productivity platforms, such routing mistakes can still have real integrity impact even without overtly malicious code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The inline guidance contradicts itself about whether requests involving '表格' and related non-document types should be handled, while other sections say the skill should not trigger for multidimensional tables. Contradictory intent instructions make tool routing nondeterministic and can cause the agent to perform the wrong operation, especially where '表格' may mean online spreadsheet versus multidimensional table. That ambiguity creates a practical integrity risk for user data and resource creation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The intent section explicitly tells the agent to handle 多维表 creation, directly conflicting with the manifest's instruction that such requests should not trigger this skill. When trigger criteria and execution guidance disagree, the agent may act outside intended scope and create or modify resources in the wrong product area. The danger is amplified because this is actionable operational guidance, not just a stray comment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest advertises broad keyword-based activation such as '云文档', '在线文档', and related phrases, while only loosely excluding some unrelated scenarios. This can cause the skill to activate in ambiguous contexts and perform document-oriented actions when the user did not intend to invoke this integration, increasing the risk of unintended access to or modification of remote documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description states the skill can create documents, create folders, and write document content, but it does not clearly warn that these are remote state-changing operations affecting user or enterprise data. In an agent environment, omission of this warning increases the chance of users or orchestrators invoking destructive or unintended modifications without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The credential is described as a Streamable HTTP URL that includes an access token, which is highly sensitive because URLs are often logged, echoed in diagnostics, stored in shell history, or exposed through configuration tooling. If leaked, the token could allow unauthorized access to the backing DingTalk document service and potentially broad document operations depending on scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains all operational instructions, warnings, and examples only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata says it should not be triggered for multi-dimensional tables, yet the reference explicitly documents creation of non-document artifact types such as tables, PPTs, whiteboards, mind maps, videos, images, PDFs, and folders. This creates a scope mismatch that can cause an agent to invoke capabilities beyond the declared user-facing boundary, leading to unintended actions or policy bypass in orchestration layers that trust the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file is in scope for natural-language policy checks. The top-level documentation and runtime messages are entirely in Chinese, with no opt-in, fallback, or justification that the skill is intended only for Chinese-speaking users or a China-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring is entirely in Chinese, and the script's user-facing interface is presented only in Chinese. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mcporter_utils.py (reported line 32)May include surrounding context.

python

if args:
        command.extend(['--args', json.dumps(args, ensure_ascii=False)])
    try:
        result = subprocess.run(
            command,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains a top-level docstring entirely in Chinese, which imposes a specific language in user- or maintainer-facing natural language without any opt-in or alternative. The policy for SQP-3 applies to all file types, including code comments and string literals.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.