Use Dingding

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:36 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent DingTalk business-workspace integration, but it needs review because it documents unsafe remote installer execution and includes examples for unattended business approvals.

Install only after reviewing the dws CLI source or using a verified release/build path; avoid the pipe-to-shell installer commands. Use a least-privilege DingTalk app, test in a sandbox tenant, keep --dry-run as the default for mutations, and do not allow unattended approvals, bulk messaging, deletions, or employee-data queries without explicit human review.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:52
• Finding: Unpinned Remote Installer Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 52-57 **Vulnerability Type**: Remote payload retrieval and execution without integrity verification **Risk Level**: High ### Vulnerable Code ```bash # macOS / Linux - REVIEW SCRIPT BEFORE RUNNING curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh # Windows (PowerShell) - REVIEW SCRIPT BEFORE RUNNING irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex ``` ### Technical Analysis The installation instructions download scripts from the mutable `main` branch of an external GitHub repository and immediately execute them using `sh` or PowerShell `Invoke-Expression`. No version, commit, cryptographic digest, or signature is pinned or verified. Although the comments tell users to review the scripts, piping the downloaded response directly into an interpreter does not provide a meaningful review step. The content executed can differ from content reviewed earlier because the `main` branch is mutable. Installation of the external `dws` binary is necessary for the declared DingTalk integration, but direct execution of mutable remote source is not the minimum privilege or minimum-risk mechanism required. The same document already offers safer alternatives, including downloading a release artifact or building from source. This finding does not establish that the current upstream installer is malicious. The vulnerability is that control of the effective payload remains with an external, changeable source after this skill has been reviewed. ### Attack Path 1. An attacker compromises the upstream GitHub organization, repository, maintainer account, release workflow, or another mechanism capable of modifying the installer on the `main` branch. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. A user or agent follows the d ...[truncated 1270 chars]
• Remediation: ## Remediation Suggestions 1. Remove all `curl | sh` and `irm | iex` installation instructions. 2. Pin installation artifacts to a specific immutable release version or commit rather than the `main` branch. 3. Publish expected SHA-256 checksums through a separately protected release channel and require verification before execution. 4. Prefer signed release artifacts and verify the publisher signature or provenance before installation. 5. Separate download, inspection, verification, and execution into explicit commands. For example: ```bash version="vX.Y.Z" curl -fL -o install.sh \ "https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/${version}/scripts/install.sh" printf '%s %s\n' 'EXPECTED_SHA256' install.sh | sha256sum --check - less install.sh sh install.sh ``` 6. Provide an equivalent Windows workflow using `Invoke-WebRequest -OutFile`, `Get-FileHash`, signature validation, local inspection, and only then explicit execution. 7. Recommend running installation as an unprivileged user and prohibit `sudo`, administrator shells, or elevation unless a documented operation strictly requires it. 8. Keep credentials unset during installation so a compromised installer cannot inherit `DWS_CLIENT_ID`, `DWS_CLIENT_SECRET`, or active tokens. 9. Prefer verified package-manager distribution or reproducible builds from a pinned source revision.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (42)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS / Linux - REVIEW SCRIPT BEFORE RUNNING
curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

# Windows (PowerShell) - REVIEW SCRIPT BEFORE RUNNING
irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex

• Confidence: 97% confidence
• Finding: Piping `curl` output to `sh` and `irm` to `iex` is a classic command-chaining anti-pattern that results in immediate execution of untrusted remote content. In an agent skill context, this is especially risky because automated systems may copy the command verbatim, turning documentation into code execution without meaningful review.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
dws auth login --client-id <your-app-key> --client-secret <your-app-secret>
# Tokens stored encrypted in system Keychain (macOS/Windows) or libsecret (Linux)
```

**Alternative: Environment Variables (use with caution)**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# OAuth credentials for DingTalk
  # Can be provided via env vars OR interactive login (recommended)
  # Interactive login stores tokens encrypted in system keychain
  env:
    - name: DWS_CLIENT_ID
      description: DingTalk App Key from Open Platform Console

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Instruction Override

High

• Category: Prompt Injection

Content

### Step 1: Identify Error Type

```bash
# Enable debug mode
export DWS_DEBUG=1
dws <command>
```

• Confidence: 70% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Exfiltration Commands

High

• Category: Prompt Injection

Content

## Common Patterns

### Send Message to Multiple Groups

```bash
# Get group IDs

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The auto-approve batch example performs bulk, non-interactive approvals using simple title matching for 'Expense', which is a weak decision criterion and can approve unintended requests at scale. This is especially dangerous because it normalizes automation of privileged business decisions without validation, thresholds, ownership checks, or human review.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The helper run_dws expects execute=True to append --yes and execute=False to append --dry-run, but create_todo passes its dry_run parameter directly into run_dws as the execute argument. In main, the user-facing --execute flag is then passed as execute=execute into create_todo, causing default runs to mutate state and --execute runs to dry-run instead, which defeats the documented safety control and can trigger unintended task creation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### For Agents

- **`--dry-run`**: **ALWAYS use first** for mutations to preview API calls
- **`--yes`**: Skip confirmation prompts (use only after verifying with --dry-run)
- **`--jq`**: Extract specific fields to reduce token consumption
- **`--fields`**: Return only needed fields

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### For Agents

- **`--dry-run`**: **ALWAYS use first** for mutations to preview API calls
- **`--yes`**: Skip confirmation prompts (use only after verifying with --dry-run)
- **`--jq`**: Extract specific fields to reduce token consumption
- **`--fields`**: Return only needed fields

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Report vs Todo

**User says:** "Create a task to submit weekly report"

**Analysis:**
- If they want to **track** the work → `todo task create`

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```
Is the user asking to:
├─ Track/remember to do something? → todo
│  └─ "remind me to...", "create a task to...", "add to my todo"
└─ Actually perform the action? → specific product
   └─ "submit a report" → report create
   └─ "send a message" → chat message send

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file describes a delete operation for records but provides no warning that the action is destructive or may permanently remove data. Under the markdown-specific missing-warning rule, destructive behaviours that affect user data should be accompanied by a caution or confirmation note.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation includes a field delete command without any warning that removing a field can alter table schema and may remove associated data visibility or content. For markdown skill descriptions, potentially irreversible operations affecting user data or system integrity should include explicit cautionary language.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file includes examples for listing shift schedules and, elsewhere, team/member attendance lookups using arbitrary user IDs and department IDs, which can reveal employee attendance information. The document does not warn that these commands may access sensitive personnel data or that users should ensure they are authorized before querying others' records.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents `dws calendar event delete --event-id <eventId>` as a direct deletion operation, but it provides no warning that the action removes calendar data and no note to confirm the target event before running it. For markdown files, destructive behaviors that can affect user data should be disclosed so users understand the impact before invoking the command.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The `participant busy` examples query the busy slots of multiple user IDs, which can reveal other users' availability information. The markdown does not include any notice about privacy sensitivity, authorization expectations, or appropriate use of participant schedule data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file documents safety-relevant operations such as recalling messages, creating groups, and adding or removing members, but provides no warning that these actions modify live chat state and can affect other users. Under the markdown-file criteria, descriptions should disclose behaviors that may affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file includes examples for searching users by name, mobile, or email and printing returned contact fields such as mobile numbers. Because the skill description exposes operations over personal/contact data, it should warn users about privacy implications and appropriate authorization before use.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation shows how to list department members and output names and user IDs, which can reveal organization directory information at scale. The markdown omits any caution about access control, privacy, or responsible handling of exported member data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document provides commands to approve instances with the non-interactive '--yes' flag but does not warn that these actions immediately change workflow state and may bypass a human confirmation checkpoint. In an approval system, publishing destructive or state-changing examples without caution increases the risk of accidental or scripted misuse by operators and downstream agents.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The rejection and revocation commands are documented as straightforward operations without warning that they can have irreversible or hard-to-recover business consequences. Users or agents may execute them based on incomplete context, causing denial of legitimate requests, disruption of workflows, or unintended rollback of active approvals.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Common Patterns

### Auto-Approve Low-Value Requests

```bash
# Get pending approvals

• Confidence: 94% confidence
• Finding: The section explicitly promotes autonomous approval of requests, which delegates business authorization decisions to simplistic automation. In the context of an OA approval system, that increases the chance of unauthorized approvals, policy violations, and financial or compliance harm because approvals are inherently sensitive control points.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Approve each
for inst in $INSTANCES; do
  dws oa approval approve --instance-id "$inst" --comment "Auto-approved" --yes
done
```

• Confidence: 95% confidence
• Finding: The loop issues automatic approval commands with '--yes' for each matched instance, turning a sensitive authorization process into unattended execution. This creates a direct path to mass approval mistakes or abuse if inputs are malformed, manipulated, or broader than expected.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This markdown file documents a delete operation for tasks, but provides no warning that the action may remove user data or be irreversible. Under the markdown-file criteria for missing user warnings, descriptions of behaviors affecting user data should disclose the risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script allows querying multiple users' busy schedule data and presents it as a normal utility without any warning, consent check, or visible authorization guard. In an agent-skill context, this can enable privacy-invasive enumeration of coworkers' availability if the surrounding execution environment supplies calendar access on behalf of the operator or agent.

Static analysis

No suspicious patterns detected.