Security audit

dingtalk-minutes

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DingTalk minutes reader and local exporter, with sensitive meeting-data handling that users should control carefully.

Install only if you are authorized to access the DingTalk minutes involved. Treat archived transcripts, summaries, todos, audio URLs, and optional audio files as sensitive business data; choose private output directories, avoid shared or cloud-synced mirror targets unless intended, verify the dws installer before running it, and remove temporary auth logs after login.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exercises sensitive capabilities including shell execution, network access, and local file read/write, but does not declare permissions or clearly constrain them through a permission model. This increases the chance of overbroad execution in agent environments, making data exfiltration or unintended local persistence harder for users and platforms to reason about.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented primarily as a read-only wrapper for querying DingTalk minutes, but it also persists transcripts, summaries, todos, metadata, and optionally audio to local storage and can mirror that data into external folders. For meeting minutes, these side effects materially expand the data exposure surface because highly sensitive content is duplicated outside the original service boundary and may be copied into other tools or sync paths.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The document frames the skill as read-only, but explicitly states that `scripts/sync.py` performs pagination and writes retrieved minutes/transcript data to disk. This is a real data-handling inconsistency: while not a direct exploit primitive, it can mislead operators into underestimating local retention of potentially sensitive meeting content.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script can persist aggregated AI meeting summaries to an arbitrary local Markdown file, which changes the security posture from transient read access to durable local data storage. Because meeting summaries may contain sensitive business or personal information, writing them to disk can create unintended data exposure, retention, and endpoint-compromise risk.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Allowing the caller to choose any output path enables arbitrary local file writes within the user's permissions, even though the skill is framed primarily as a read/query wrapper. While the content written comes from retrieved summaries rather than attacker-crafted shell input, this still permits unintended overwrites of local files and broader data-handling than the skill description implies.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script performs automatic mirroring of archived minutes content to an external folder, which expands data flow beyond the stated read/query purpose of the skill. Because the archived content includes sensitive transcripts, summaries, todos, and metadata, this creates an unintended exfiltration/copying channel and increases the blast radius if the mirror target is insecure or shared.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill can download and persist full audio recordings locally, which exceeds the described scope of reading/querying audio addresses. Persisting raw meeting audio materially increases privacy and retention risk because it stores the most sensitive source material, potentially including confidential speech, in local archives that may be less protected than the original service.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Invoking a secondary script to mirror archived content to an external folder introduces a capability not justified by the skill’s documented minutes-reading role. In context, the mirrored data includes transcripts and derived artifacts, so this materially increases the risk of unauthorized disclosure, accidental propagation, and policy bypass around data residency or retention.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file documents retrieval of full transcripts and audio download URLs, both of which can expose highly sensitive meeting content, but it provides no user-facing privacy warning or consent guidance. In a skill specifically designed to access AI minutes, this omission increases the risk of inappropriate collection, sharing, or downstream use of private communications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The note that `scripts/sync.py` already handles pagination and persistence to disk omits any warning that sensitive transcript data will be stored locally and may remain after use. For minutes/transcripts, local copies materially expand exposure surface through endpoint compromise, backups, shared filesystems, or accidental disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup guide tells users to fetch and execute a shell script directly from the internet with `curl ...` followed by `sh /tmp/dws-install.sh`, but it does not warn about the risk of remote code execution or recommend verifying integrity. If the upstream repository, CDN path, or network path is compromised, users could execute attacker-controlled code during installation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The instructions redirect authentication output containing the device code and verification URL into `/tmp/dws-auth.log` without warning that this file may be readable by other local users or exposed via shared temp locations. While device codes are short-lived, disclosure could let another party complete or interfere with the login flow and expose account/organization access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script stores merged meeting summaries on disk without any explicit warning that potentially sensitive meeting content will be persisted locally. In a minutes-reading skill, this is more dangerous because users may expect read-only retrieval, not durable exports that can be indexed, backed up, or accessed by other local processes.

Static analysis

No suspicious patterns detected.