Security audit

Dingtalk Ai Table Only Curl

Security checks across malware telemetry and agentic risk

Overview

This DingTalk table skill appears related to its stated purpose, but it needs Review because it stores DingTalk credentials locally and can change or delete business table data with incomplete safeguards.

Install only if you trust the publisher and intend to grant DingTalk table read/write access. Use a least-privileged DingTalk app, avoid shared machines, restrict the local config file permissions, and require explicit confirmation with target IDs before any record, field, or sheet deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to execute shell commands (`bash scripts/dt_helper.sh`, writing scripts to `/tmp`, and running `curl`) but does not declare shell/code-execution permissions. This creates a hidden capability boundary: reviewers or policy systems may underestimate the skill’s power, while the skill can access local files, credentials, and network resources through the shell.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is AI table CRUD, but the skill also manages authentication tokens, caches credentials, reads and writes local configuration, and performs identity conversion between user identifiers. That mismatch is security-relevant because users may invoke the skill expecting limited table operations while it can handle broader sensitive identity and secret-management tasks, increasing the chance of credential misuse or unintended data access.

Description-Behavior Mismatch

Medium

Confidence: 75% confidence
Finding: The script includes user identity conversion functions unrelated to the stated AI-table purpose, allowing operator and other user identifiers to be resolved through DingTalk APIs. In a skill context, this expands access to personnel identity data and enables collection of identifiers that are unnecessary for the advertised workflow, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The helper exposes arbitrary configuration read/write operations, including persistence of sensitive DingTalk keys and tokens, which exceeds the narrow AI-table function described for the skill. Broad config mutation increases the chance of credential mishandling, secret exposure, or unsafe state changes by users or calling components.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list is overly broad and includes generic terms like '工作表', '字段', '记录', '新增记录', and '删除记录', which can appear in unrelated contexts. This raises the risk of accidental invocation of a skill that can read/write local config, obtain tokens, and perform destructive remote operations against DingTalk tables when the user did not intend to use this integration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The delete-records endpoint documents a destructive operation without the same explicit user-confirmation warning used elsewhere for deleting sheets and fields. In an agent skill, that omission increases the chance the model will execute irreversible data deletion from a casual or ambiguous user request, causing integrity loss and accidental data destruction.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script explicitly stores app secrets and access tokens in a local plaintext config file under the user's home directory, with no permission hardening or warning at the point of setup. If the file is readable by other local users, included in backups, or accidentally shared, attackers can reuse the credentials to access DingTalk APIs and impersonate the application.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.