Security audit

Use Dingding

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DingTalk business-workspace integration, but it needs review because it documents unsafe remote installer execution and includes examples for unattended business approvals.

Install only after reviewing the dws CLI source or using a verified release/build path; avoid the pipe-to-shell installer commands. Use a least-privilege DingTalk app, test in a sandbox tenant, keep --dry-run as the default for mutations, and do not allow unattended approvals, bulk messaging, deletions, or employee-data queries without explicit human review.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:52
Finding: Unpinned Remote Installer Scripts Are Executed Directly
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 52-57
Vulnerability Type: Remote payload retrieval and execution without integrity verification
Risk Level: High

Vulnerable Code

bash
# macOS / Linux - REVIEW SCRIPT BEFORE RUNNING curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh # Windows (PowerShell) - REVIEW SCRIPT BEFORE RUNNING irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex

Technical Analysis

The installation instructions download scripts from the mutable main branch of an external GitHub repository and immediately execute them using sh or PowerShell Invoke-Expression. No version, commit, cryptographic digest, or signature is pinned or verified.

Although the comments tell users to review the scripts, piping the downloaded response directly into an interpreter does not provide a meaningful review step. The content executed can differ from content reviewed earlier because the main branch is mutable.

Installation of the external dws binary is necessary for the declared DingTalk integration, but direct execution of mutable remote source is not the minimum privilege or minimum-risk mechanism required. The same document already offers safer alternatives, including downloading a release artifact or building from source.

This finding does not establish that the current upstream installer is malicious. The vulnerability is that control of the effective payload remains with an external, changeable source after this skill has been reviewed.

Attack Path

An attacker compromises the upstream GitHub organization, repository, maintainer account, release workflow, or another mechanism capable of modifying the installer on the main branch.

The attacker replaces install.sh or install.ps1 with a malicious payload.

A user or agent follows the d ...[truncated 1270 chars]
Remediation: View remediation
Remediation Suggestions

Remove all curl | sh and irm | iex installation instructions.

Pin installation artifacts to a specific immutable release version or commit rather than the main branch.

Publish expected SHA-256 checksums through a separately protected release channel and require verification before execution.

Prefer signed release artifacts and verify the publisher signature or provenance before installation.

Separate download, inspection, verification, and execution into explicit commands. For example:

bash
version="vX.Y.Z" curl -fL -o install.sh \ "https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/${version}/scripts/install.sh" printf '%s %s\n' 'EXPECTED_SHA256' install.sh | sha256sum --check - less install.sh sh install.sh

Provide an equivalent Windows workflow using Invoke-WebRequest -OutFile, Get-FileHash, signature validation, local inspection, and only then explicit execution.

Recommend running installation as an unprivileged user and prohibit sudo, administrator shells, or elevation unless a documented operation strictly requires it.

Keep credentials unset during installation so a compromised installer cannot inherit DWS_CLIENT_ID, DWS_CLIENT_SECRET, or active tokens.

Prefer verified package-manager distribution or reproducible builds from a pinned source revision.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (42)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Piping curl output to sh and irm to iex is a classic command-chaining anti-pattern that results in immediate execution of untrusted remote content. In an agent skill context, this is especially risky because automated systems may copy the command verbatim, turning documentation into code execution without meaningful review.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
bash
# macOS / Linux - REVIEW SCRIPT BEFORE RUNNING curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh # Windows (PowerShell) - REVIEW SCRIPT BEFORE RUNNING irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
bash
dws auth login --client-id <your-app-key> --client-secret <your-app-secret> # Tokens stored encrypted in system Keychain (macOS/Windows) or libsecret (Linux)

Alternative: Environment Variables (use with caution)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawhub.yml (reported line 27)May include surrounding context.
yaml
# OAuth credentials for DingTalk # Can be provided via env vars OR interactive login (recommended) # Interactive login stores tokens encrypted in system keychain env: - name: DWS_CLIENT_ID description: DingTalk App Key from Open Platform Console

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/error-codes.md (reported line 203)May include surrounding context.
Step 1: Identify Error Type

bash
# Enable debug mode export DWS_DEBUG=1 dws <command>

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · references/products/chat.md (reported line 105)May include surrounding context.
Common Patterns

Send Message to Multiple Groups

bash
# Get group IDs

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The auto-approve batch example performs bulk, non-interactive approvals using simple title matching for 'Expense', which is a weak decision criterion and can approve unintended requests at scale. This is especially dangerous because it normalizes automation of privileged business decisions without validation, thresholds, ownership checks, or human review.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The helper run_dws expects execute=True to append --yes and execute=False to append --dry-run, but create_todo passes its dry_run parameter directly into run_dws as the execute argument. In main, the user-facing --execute flag is then passed as execute=execute into create_todo, causing default runs to mutate state and --execute runs to dry-run instead, which defeats the documented safety control and can trigger unintended task creation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
### For Agents - **`--dry-run`**: **ALWAYS use first** for mutations to preview API calls - **`--yes`**: Skip confirmation prompts (use only after verifying with --dry-run) - **`--jq`**: Extract specific fields to reduce token consumption - **`--fields`**: Return only needed fields

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/global-reference.md (reported line 88)May include surrounding context.
md
### For Agents - **`--dry-run`**: **ALWAYS use first** for mutations to preview API calls - **`--yes`**: Skip confirmation prompts (use only after verifying with --dry-run) - **`--jq`**: Extract specific fields to reduce token consumption - **`--fields`**: Return only needed fields

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/intent-guide.md (reported line 7)May include surrounding context.
md
## Report vs Todo **User says:** "Create a task to submit weekly report" **Analysis:** - If they want to **track** the work → `todo task create`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/intent-guide.md (reported line 17)May include surrounding context.
text
Is the user asking to: ├─ Track/remember to do something? → todo │ └─ "remind me to...", "create a task to...", "add to my todo" └─ Actually perform the action? → specific product └─ "submit a report" → report create └─ "send a message" → chat message send

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file describes a delete operation for records but provides no warning that the action is destructive or may permanently remove data. Under the markdown-specific missing-warning rule, destructive behaviours that affect user data should be accompanied by a caution or confirmation note.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation includes a field delete command without any warning that removing a field can alter table schema and may remove associated data visibility or content. For markdown skill descriptions, potentially irreversible operations affecting user data or system integrity should include explicit cautionary language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes examples for listing shift schedules and, elsewhere, team/member attendance lookups using arbitrary user IDs and department IDs, which can reveal employee attendance information. The document does not warn that these commands may access sensitive personnel data or that users should ensure they are authorized before querying others' records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents dws calendar event delete --event-id <eventId> as a direct deletion operation, but it provides no warning that the action removes calendar data and no note to confirm the target event before running it. For markdown files, destructive behaviors that can affect user data should be disclosed so users understand the impact before invoking the command.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The participant busy examples query the busy slots of multiple user IDs, which can reveal other users' availability information. The markdown does not include any notice about privacy sensitivity, authorization expectations, or appropriate use of participant schedule data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file documents safety-relevant operations such as recalling messages, creating groups, and adding or removing members, but provides no warning that these actions modify live chat state and can affect other users. Under the markdown-file criteria, descriptions should disclose behaviors that may affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes examples for searching users by name, mobile, or email and printing returned contact fields such as mobile numbers. Because the skill description exposes operations over personal/contact data, it should warn users about privacy implications and appropriate authorization before use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation shows how to list department members and output names and user IDs, which can reveal organization directory information at scale. The markdown omits any caution about access control, privacy, or responsible handling of exported member data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document provides commands to approve instances with the non-interactive '--yes' flag but does not warn that these actions immediately change workflow state and may bypass a human confirmation checkpoint. In an approval system, publishing destructive or state-changing examples without caution increases the risk of accidental or scripted misuse by operators and downstream agents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The rejection and revocation commands are documented as straightforward operations without warning that they can have irreversible or hard-to-recover business consequences. Users or agents may execute them based on incomplete context, causing denial of legitimate requests, disruption of workflows, or unintended rollback of active approvals.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The section explicitly promotes autonomous approval of requests, which delegates business authorization decisions to simplistic automation. In the context of an OA approval system, that increases the chance of unauthorized approvals, policy violations, and financial or compliance harm because approvals are inherently sensitive control points.
Content: Scanner excerpt · references/products/oa.md (reported line 82)May include surrounding context.
Common Patterns

Auto-Approve Low-Value Requests

bash
# Get pending approvals

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The loop issues automatic approval commands with '--yes' for each matched instance, turning a sensitive authorization process into unattended execution. This creates a direct path to mass approval mistakes or abuse if inputs are malformed, manipulated, or broader than expected.
Content: Scanner excerpt · references/products/oa.md (reported line 90)May include surrounding context.
Approve each

for inst in $INSTANCES; do dws oa approval approve --instance-id "$inst" --comment "Auto-approved" --yes done

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents a delete operation for tasks, but provides no warning that the action may remove user data or be irreversible. Under the markdown-file criteria for missing user warnings, descriptions of behaviors affecting user data should disclose the risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script allows querying multiple users' busy schedule data and presents it as a normal utility without any warning, consent check, or visible authorization guard. In an agent-skill context, this can enable privacy-invasive enumeration of coworkers' availability if the surrounding execution environment supplies calendar access on behalf of the operator or agent.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Chaining Abuse

Credential Access

Credential Access

Instruction Override

Step 1: Identify Error Type

Exfiltration Commands

Common Patterns

Send Message to Multiple Groups

Missing User Warnings

Intent-Code Divergence

Autonomous Decision Making

Autonomous Decision Making

Session Persistence

Session Persistence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Common Patterns

Auto-Approve Low-Value Requests

Autonomous Decision Making

Approve each

Missing User Warnings

Missing User Warnings