Security audit
Security checks for vulnerabilities and agentic risk
This DingTalk Bitable skill is purpose-aligned but needs Review because it can directly create, update, and delete live remote records using local credentials without built-in confirmation or target scoping.
Install only if you intend the agent to access and modify DingTalk Bitable data. Use least-privilege DingTalk app credentials, avoid broad workspace permissions, and require human confirmation before delete, update, or schema-change requests.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"appSecret": client_secret
}
response = requests.post(url, headers=headers, json=body, timeout=30)
response.raise_for_status()
result = response.json()
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers["x-acs-dingtalk-access-token"] = access_token
if method.upper() == "GET":
response = requests.get(url, headers=headers, params=params or body or {}, timeout=30)
else:
response = requests.request(
method=method.upper(),
Referenced artifact was not completely inspected
- `SKILL.md` - 技能定义
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
return client_id, client_secret
# ======================= Access Token 管理 =======================
_token_cache = {}
The skill advertises network, environment, and file-read capable implementation but does not declare any explicit tool scope or permission boundaries. In an agent setting, this weakens least-privilege controls and makes it easier for the skill to access credentials, local files, or remote endpoints beyond what a user would reasonably expect.
The invocation description is broad enough to trigger on generic table, database, or spreadsheet requests, not just DingTalk Bitable tasks. Over-broad routing can cause the agent to invoke this skill in unrelated contexts, exposing credentials or causing unintended external API operations against DingTalk data.
The skill prominently exposes create, update, delete, and batch operations without warning that these actions modify or remove live remote data. In an agent workflow, that increases the risk of accidental destructive actions, especially if the skill is auto-selected or used without clear user confirmation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"appSecret": client_secret
}
response = requests.post(url, headers=headers, json=body, timeout=30)
response.raise_for_status()
result = response.json()
The skill exposes a destructive delete operation with no built-in confirmation, dry-run mode, or safety interlock. In agent-driven contexts, ambiguous prompts, prompt injection, or operator mistakes can trigger irreversible record deletion, making the absence of a confirmation step meaningfully dangerous.
The manifest exposes record creation, update, deletion, and schema modification capabilities directly, but provides no indication of confirmation requirements, scope restrictions, or user-safety guidance for destructive actions. In an agent setting, this increases the chance that a prompt misunderstanding, prompt injection, or unsafe automation could cause unintended data loss or unauthorized modification of business records.
The CLI exposes a destructive delete operation that executes immediately when invoked, with no confirmation prompt, dry-run mode, or other guardrail in this entrypoint. In an agent/tooling context, that increases the chance of accidental or unauthorized data loss if the tool is called with the wrong record_id or under prompt-manipulated instructions.
The skill states that credentials are automatically read from channel configuration but provides no warning about sensitive-data handling, logging, or scope of access. While not inherently malicious, this can normalize silent credential use and increase the chance of accidental disclosure or over-trusting the skill with privileged access.
The manifest describes a DingTalk bitable integration for table management and data CRUD, but does not mention local credential discovery from environment variables or ~/.openclaw/openclaw.json. While authentication is needed for the API, reading arbitrary local configuration files is an additional capability beyond the stated user-facing purpose.
The function accesses credential material from environment variables and a local configuration file, but the code provides no user-facing disclosure, logging, or warning that sensitive secrets will be read from the runtime environment. Under the code-file criteria, access to sensitive environment variables or credentials should include some visible explanation unless already warned elsewhere.
The shared request helper sends data to the DingTalk API, including record contents in create, update, and search operations, but the code does not provide a visible warning, log, or explanatory notice that user or system data will be transmitted over the network. For code files, outbound HTTP transmission of data should have some form of disclosure unless it is clearly documented elsewhere.
Natural-language strings in the module description, usage output, parameter errors, and tool messages are all presented only in Chinese, with no indication of language choice or opt-in. This can violate a language/locale policy when the skill implicitly forces one language for all users.
No suspicious patterns detected.