Security audit

DingTalk Push

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk notification skill mostly matches its stated purpose, but its configuration can silently redirect messages to arbitrary or non-HTTPS endpoints, so it should be reviewed before installation.

Install only if you are comfortable with the agent sending selected message content to DingTalk. Store webhook and signing secrets as protected secrets, avoid placing .dingtalk-push.json in shared or untrusted repositories, require HTTPS DingTalk webhook URLs, and review messages before sending sensitive content or using @all.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: send.js:17
Finding: Untrusted Local Configuration Can Redirect Messages to Arbitrary HTTP Endpoints
Content: View full analysis
{ ``` ### Technical Analysis The configuration loader searches for `.dingtalk-push.json` in the current working directory and merges file-controlled properties after environment-derived properties: ```javascript return { ...defaultConfig, ...fileConfig }; ``` As a result, a working-directory configuration file can silently override an explicitly configured `DINGTALK_WEBHOOK` or `DINGTALK_SECRET`. This is unsafe when the command is run from an untrusted or collaboratively maintained repository. The resulting webhook is accepte ...[truncated 2676 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to configure a DingTalk webhook and secret for outbound messaging but does not explicitly warn that messages are transmitted to an external service or that the webhook/secret are sensitive credentials. In an agent-skill context, this increases the risk of unintended data exfiltration or accidental credential exposure, especially if other skills pass task data into this notifier automatically.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are very broad and overlap with ordinary user phrasing such as '发送钉钉消息' or generic notification requests. In an agent environment, this increases the chance of accidental invocation and unintended outbound communication to a configured DingTalk webhook, which can leak operational details or spam external channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill documents external message delivery and credential configuration but does not warn users that it transmits data to a third-party service or that webhook URLs and signing secrets are sensitive credentials. This can lead users to paste secrets insecurely, expose them in logs or config files, or send sensitive content externally without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code accesses sensitive credentials via process.env.DINGTALK_WEBHOOK and process.env.DINGTALK_SECRET, and also loads equivalent values from local config files. While the header comment says this is a DingTalk push module, there is no explicit warning in comments, help text, or user-facing output that the skill consumes stored webhook credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The timestamp formatting is hard-coded to zh-CN and Asia/Shanghai, which imposes a specific language/locale choice regardless of user preference. This is a natural-language policy concern because the skill does not offer a locale option or document this as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This file exposes simple wrapper functions that forward arbitrary message content to an external DingTalk sender, enabling outbound data transmission with no confirmation, policy check, or indication to callers that data is leaving the local environment. In an agent-skill ecosystem, such generic notification helpers can be reused by other components to exfiltrate task data, secrets, or user content through a trusted messaging channel.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language content throughout the file forces a specific language/locale for users, and there is no opt-in, alternative language option, or justification that this is a region-specific skill. This matches the policy category for language or locale constraints presented without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: 文档整体仅以中文描述技能用法、触发方式和输出，没有提供语言/locale 选择，也未说明该技能仅面向特定中文使用场景。按规则，若技能强制特定语言而无用户选择或明确合理说明，可构成自然语言策略问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.