Security audit

Dingtalk CLI SKILL

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk automation skill is not clearly malicious, but it needs review because it combines broad workplace data and mutation authority with under-scoped safeguards and risky install guidance.

Install only in an organization that trusts the dws CLI publisher and the DingTalk permissions being granted. Prefer the pinned SKILL.md installer path, verify the SHA-256, avoid the README's mutable main-branch installer, store client secrets in a secret manager, and require human confirmation before deletes, approvals, broadcasts, @all messages, attendance/contact lookups, report sends, and attachment uploads.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:17
Finding: Mutable Remote PowerShell Installer Is Downloaded and Executed
Content: View full analysis
Remediation: View remediation
" $actualHash = (Get-FileHash -Algorithm SHA256 $scriptPath).Hash.ToLower() if ($actualHash -ne $expectedHash) { throw "Installer checksum verification failed" } ``` 3. Prefer shipping the reviewed installer inside the Skill package rather than retrieving executable code at installation time. 4. Digitally sign the PowerShell script and verify the Authenticode signature and expected publisher. 5. Ensure installation does not require administrator privileges unless a specific operation strictly requires them. 6. Document the exact pinned version and update it only through a new reviewed Skill release. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Privileged DingTalk Operations Depend on an External Precompiled Executable
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/upload_attachment.py:67
Finding: Attachment Contents Can Be Uploaded to an Unvalidated Destination
Content: View full analysis
bool: """Upload a file to OSS through HTTP PUT.""" file_data = file_path.read_bytes() req = Request(upload_url, data=file_data, method='PUT') req.add_header('Content-Type', mime_type) try: with urlopen(req, timeout=120) as resp: if resp.status == 200: return True ``` The destination is taken directly from the `dws` response: ```python upload_url = data.get('uploadUrl', '') file_token = data.get('fileToken', '') if not upload_url or not file_token: print(f"Error: response lacks uploadUrl or fileToken: {json.dumps(data, ensure_ascii=False)}", file=sys.stderr) return None # Step 2: PUT the file to OSS print(f"Step 2/3: Uploading file to OSS...", file=sys.stderr) if not upload_to_oss(upload_url, file_path, mime_type): return None ``` ### Technical Analysis Uploading the user-selected attachment is necessary for the declared AI-table attachment functionality. However, the script treats `uploadUrl` returned by the external `dws` process as trusted and sends the complete file contents to it without validating: - The URL scheme. - Whether TLS is required. - The destination hostname. - Whether the host belongs to an approved DingTalk or OSS domain. - Whether the URL contains an IP literal. - Whether the destination resolves to a loopback, private, link-local, or metadata-service address. - Whether redirects remain within the approved destination set. Python’s `urlopen` can follow redirects, so validation must also be applied to every redirect destination. The current implementation therefore grants the external CLI control over where a local file is transmitted. ### Attack Path ...[truncated 1687 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (58)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: dingtalk-dws description: "Dingtalk CLI SKILL / 钉钉 dingding / dingtalk dws skill — Manage DingTalk products (AI forms, calendar, contacts, bots, todos, approvals, attendance, reports, DING, workbench). Manage DingTalk products: AI表格、日历、通讯录、群聊机器人、待办、审批、考勤、日报周报、DING消息、工作台" version: "1.0.12"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/global-reference.md (reported line 23)May include surrounding context.
md
| Token | 有效期 | 说明 | |-------|--------|------| | Access Token | 2 小时 | 调用 API 的凭证，过期自动刷新 | | Refresh Token | 30 天 | 换新 Access Token，使用后轮转 | 30 天内使用一次即自动续期。

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/global-reference.md (reported line 24)May include surrounding context.
md
| Token | 有效期 | 说明 | |-------|--------|------| | Access Token | 2 小时 | 调用 API 的凭证，过期自动刷新 | | Refresh Token | 30 天 | 换新 Access Token，使用后轮转 | 30 天内使用一次即自动续期。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document is written entirely in Chinese and directs agents to consult it when errors occur, but it does not offer any language choice or indicate that the Chinese-only format is a justified region-specific constraint. This can violate language/locale policy where users or agents are expected to operate in their preferred language unless they opt in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document instructs users to place OAuth client credentials in environment variables but does not warn that these values are sensitive secrets, may leak through shell history, process inspection, CI logs, or misconfigured debugging, and should be scoped and rotated carefully. In a CI/CD and headless-auth context, this omission materially increases the chance of credential exposure through operational misuse rather than direct code execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire guide is written in Chinese and presents all user utterance examples, routing instructions, and command guidance only in Chinese. This imposes a specific language/locale on skill behavior without any stated opt-in, alternative language support, or justification for a China-specific scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document exposes high-impact operations including create, update, and irreversible delete for bases, tables, fields, and records, but does not require a consistent confirmation gate or impact preview before execution. This makes accidental or prompt-induced destructive actions more likely, especially because the same skill also documents the exact IDs and workflows needed to perform deletion quickly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The intent-mapping section uses broad trigger words such as '表格/数据/查看/修改/删除', which can overlap with ordinary conversation and cause the agent to select this skill when the user did not clearly intend AI table operations. In a skill that supports destructive actions like delete and update, ambiguous invocation increases the chance of unintended data access or modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes commands for retrieving individual attendance records, summaries, and team shift data, which are sensitive HR/personnel data, but it provides no privacy warning, authorization guidance, or role-based access constraints. In an agent setting, this can normalize broad access to employee attendance information and increase the chance of unauthorized collection or disclosure of personal data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The intent mappings use very broad natural-language triggers such as '打卡记录/出勤/考勤' and '排班/班次/当班' without requiring identity, scope, or confirmation constraints. This can cause an agent to over-trigger attendance commands from ordinary conversation and potentially query sensitive employee data for unintended users or teams.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The intent-mapping section uses broad natural-language trigger phrases such as '日程/会议/约会/日历', '查看', and '有空吗/忙不忙/闲忙' to route users into calendar actions. In an agentic context, these generic phrases can overlap with ordinary conversation and cause unintended execution of read or write operations such as listing events, creating meetings, or querying availability without sufficiently explicit user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The webhook messaging guidance instructs use of a raw --token <robotToken> and shows examples for broadcasting alerts, including --at-all, but provides no warning that the token is a sensitive secret or that use of the webhook can trigger external message delivery. In practice, this can lead to credential exposure in prompts, logs, transcripts, screenshots, or command history, enabling unauthorized parties to send spoofed or disruptive messages to enterprise chat recipients.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The intent-mapping section uses broad natural-language triggers like '帮我建个群', '改一下群名', and '让机器人在群里发通知', which can over-match casual conversation and cause the agent to select a state-changing command without sufficient disambiguation. In this skill, several mapped actions modify group membership, rename chats, or send messages, so an over-eager matcher increases the risk of unintended operations and social-engineering-driven misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation explicitly enables searching users by mobile number and bulk retrieval of user details or department members, but it provides no privacy, authorization, or least-privilege guidance. In an agentic environment, this can normalize high-volume directory lookups and personal data access, increasing the chance of employee enumeration or misuse of personally identifiable information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 该 markdown 文件包含“意图判断”规则，适用 SQP-1。像“找人/搜人”“哪个部门”“部门有谁/部门成员”这类短语非常常见，且未说明触发边界、适用上下文或排除条件，容易把普通对话误判为技能调用。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The cross-product mapping instructs consumers to extract orgAuthEmail from contact data and reuse it in a mail-sending workflow, but it does not mention consent, purpose limitation, or data-sharing controls. This creates a realistic path for unnecessary propagation of directory-derived personal data into other systems, enabling spam, misdelivery, or broader privacy violations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly supports creating a report and sending it to chat recipients or specific user IDs, but it does not warn about disclosure risks or require explicit user acknowledgment of the recipients. In an agent workflow, this can lead to accidental sharing of sensitive work content with unintended recipients, especially when recipient IDs are provided programmatically or inferred from context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent mapping uses broad trigger phrases such as “查日志/看日报” and “写日报/提交周报/发日志/填日志,” which can overlap with ordinary conversational language. In an agent setting, this can cause the wrong action path to be selected, including reading inbox reports or initiating report creation when the user’s intent was ambiguous, increasing the risk of unintended data access or actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill documents state-changing approval operations such as approve, reject, and revoke with no requirement for confirmation, no caution about side effects, and no guardrails around when those commands should be used. In an agent setting, that increases the risk that ambiguous user language or stale context could trigger unauthorized workflow actions affecting business processes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The intent mapping is broad enough that common workplace phrases like '审批/请假/报销/出差' may route the agent into approval workflows without sufficient disambiguation between viewing information and taking action. In combination with the documented approve/reject/revoke commands and context passing of instance/task IDs, this can enable unintended or premature state-changing operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent mapping includes very broad, everyday phrases such as '记一下' and 'TODO' that can easily appear in normal conversation without an explicit request to create or modify a task. In an agent setting, this can cause unintended invocation of the todo skill and lead to accidental creation, modification, or deletion workflows if the system interprets ambiguous user utterances as commands.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase for fetching application details is too vague because "应用详情" does not specify how the required appId should be obtained or validated before invoking app get. In an agent setting, this can cause incorrect tool selection, use of stale or inferred IDs from prior context, or unintended disclosure of details for the wrong application.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s operative guidance is written entirely in Chinese, which imposes a language requirement on users and agents consuming the skill. The document does not provide an opt-in, alternative locale, or justification that this skill is region-specific, so it appears to violate the language/locale policy criterion.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring and usage text state the script queries '排班和出勤统计' (shifts and attendance statistics). However, the only backend operation performed is dws attendance shift list, and the output/empty-state messages also refer only to shift information, with no attendance-statistics retrieval or aggregation anywhere in the code.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The argparse description says the tool queries team member shifts and attendance statistics. In execution, the script prints a shift-query banner, calls only the shift listing command, and reports '未查到排班信息' when no results are returned, which contradicts the broader claim of also providing attendance statistics.
Content: No source excerpt is available for this finding.