Security audit

dws

Security checks across malware telemetry and agentic risk

Overview

The skill is broadly aligned with DingTalk administration, but it needs Review because it can access sensitive communications and identity data, trigger visible business actions, and mutate the local Python environment without enough consent controls.

Install only if you want a very broad DingTalk operations skill. Before use, require explicit confirmation for any message, email, task, directory change, approval, permission change, PAT grant, attendance modification, or speaker-label replacement; avoid using private chat history for speaker identification unless the affected users have clearly approved it; and preinstall dependencies rather than allowing helpers to run pip during execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (75)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: ) import subprocess, sys try: subprocess.check_call( [sys.executable, "-m", "pip", "install", "Pillow"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=60,
Confidence: 98% confidence
Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "Pillow"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=60,

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation instructs the agent to use shell commands, read local reference files and scripts, and potentially access networked DingTalk services, but it declares no corresponding permissions. This creates a transparency and governance gap: operators may approve or deploy the skill without understanding that it can invoke broad local and remote capabilities, increasing the chance of unsafe execution in sensitive environments.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest description advertises general DingTalk product operations but omits that the skill can manage PAT authorization and browser-policy related actions. Authorization-management features are security-sensitive because they can grant or influence access scope, so failing to disclose them can mislead users and reviewers about the skill's real privilege impact.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest description does not disclose that the skill supports real-time personal IM event listening, message subscription, and event-driven automation. That is materially more sensitive than ordinary CRUD operations because it can monitor live communications and trigger automated actions based on incoming messages, creating surveillance, privacy, and unintended-action risks if users are not clearly informed.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document gives mutually exclusive routing rules: earlier it forbids direct use of `dws attendance schedule get`, but the `boss-check` workflow later requires that exact command to obtain `planId`. In an agent setting, this ambiguity can cause the model to bypass mandated guardrails or choose an unsafe/incomplete path for a sensitive write operation that alters attendance records.

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The `boss-check` section says confirmation must use `--user-say-yes`, but one example uses `--yes` instead. For a sensitive administrative write action, inconsistent confirmation semantics can lead agents to invoke the wrong flag, skip intended confirmation logic, or fail open if aliases are handled unexpectedly.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file earlier establishes a critical distinction between exporting online documents via `dws doc export` and downloading ordinary files via `dws drive download`, but later reintroduces a generic '下载/导出文件' → `download` rule. In an agent skill, this contradiction can cause unsafe tool routing, leading the agent to choose the wrong command, fail to preserve intended format conversion, or mishandle sensitive document retrieval workflows.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The minutes skill documentation directs the agent to pivot into other products such as contacts, calendar, docs, todos, and reports for composite workflows. That broadens data access beyond the narrow user expectation of 'AI听记' and can cause over-collection of unrelated enterprise data if the agent follows these recipes automatically.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The speaker-identification workflow explicitly instructs mining documents, calendars, contacts, and chat records to infer the identity of anonymous speakers. This is a privacy-expanding use of unrelated data sources and risks deanonymizing participants without necessity or consent, especially when the user only asked about meeting notes.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation specifically authorizes access to recent private chat messages as a signal for identifying a speaker in meeting minutes. Private chat content is highly sensitive and unrelated to the minimal task of retrieving or summarizing minutes, so this creates an unnecessary surveillance path and significant privacy risk.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The upload workflow tells the operator to perform a raw HTTP PUT to a presigned URL outside the dws CLI surface. This extends execution outside the skill boundary, can leak sensitive media through mishandled URLs or local tooling, and bypasses centralized validation and auditing that the skill would otherwise provide.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Auto-installing Pillow during report generation expands the trust boundary from local file export to arbitrary dependency retrieval and installation. In an agent skill context this is more dangerous because the skill can modify the runtime environment and execute package installer logic without a meaningful user decision point.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The `focus-messages` recipe uses broad natural-language triggers like '最近发了什么消息' and then imposes a hard rule to execute `chat message list-focused --limit 50`, which can retrieve recent message activity from followed contacts without explicit scoping, time confirmation, or privacy checks. In a messaging/admin skill, this increases the chance of over-collection or unintended access when a vague user request is interpreted too aggressively.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: These recipes document outbound actions including bot/group messaging, forwarding messages, and creating urgent todo tasks, but they provide no guardrail to warn the user, confirm recipients, or verify consent before notifying others or changing collaboration state. In an enterprise DingTalk skill with access to chats, bots, and task workflows, a mistaken or prompt-injected invocation could spam users, leak message contents to unintended recipients, or create disruptive work items.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The recipe explicitly instructs the agent to write task data into a local file (`todos.json`) and execute a local Python script (`python scripts/todo_batch_create.py`) without any requirement for user confirmation, disclosure, or validation of the script contents. In an agent setting, local file writes and script execution expand the trust boundary and can lead to unintended code execution, data leakage, or abuse if the script or working directory is compromised.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The workflow instructs sending a group chat notification after creating a task, but it does not require explicit user confirmation of recipients, message contents, or disclosure that a broadcast will occur. In enterprise chat environments, this can cause accidental disclosure of sensitive task details, notify the wrong audience, or trigger unintended social/operational effects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The recipe explicitly instructs sending meeting summaries to users or groups, which can disclose potentially sensitive meeting content to unintended recipients if the operator chooses the wrong target or does not realize content will be forwarded externally. In a collaboration skill handling minutes, summaries often contain confidential business information, so the lack of an explicit confirmation or warning before transmission is a meaningful security and privacy gap.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow directs the agent to extract action items, create downstream todo tasks for identified users, and notify a group, but it does not require explicit user confirmation that external side effects should occur. This can cause unauthorized task creation, incorrect assignment, and premature disclosure of meeting-derived action items to others, especially if extraction or identity matching is imperfect.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guidance explicitly routes natural-language requests like creating enterprise accounts, creating enterprises, and inviting employees into state-changing directory operations without requiring confirmation, authorization checks, or a safety warning. In an agent setting, this increases the risk of unintended provisioning or organizational changes from ambiguous or malicious prompts, especially because these actions affect real accounts and org data.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill explicitly instructs querying calendar participants, recent chat messages, directory data, and documents to infer a speaker’s identity, but provides no user-facing disclosure, consent check, or data-minimization guardrail. This creates a real privacy and surveillance risk because sensitive communications and relationship data are being repurposed for identity attribution beyond the user’s direct input, which can expose personal or confidential information and lead to misidentification.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill asks whether to replace a speaker label and states that the system will remember voiceprint characteristics for future automatic recognition, which implies persistence of biometric or biometric-adjacent profiling data. Storing or reusing voiceprint-derived identity associations without an explicit privacy warning, consent record, retention policy, and controls is dangerous because biometric identifiers are highly sensitive and difficult to revoke if misused or breached.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger condition is explicitly broad: even a generic user request like '帮我标注发言人' causes the skill to activate and potentially access meeting minutes metadata, nearby calendar events, attendee lists, and contact directory data. In a skill that touches sensitive enterprise collaboration data, overly broad activation increases the risk of unintended invocation, privacy overreach, and actions being taken in the wrong user context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The recipe explicitly instructs the agent to directly execute operational commands once a flow is classified as 'lite', without requiring a confirmation or warning step before actions that can create tasks, send messages, modify documents, or change permissions. In a skill with broad write capabilities across messaging, calendar, documents, mail, approvals, and minutes, this creates a real risk of unauthorized or unintended side effects from ambiguous prompts or misclassification.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs users to place OAuth client credentials in environment variables for headless use but does not warn that environment variables can be exposed through shell history, process inspection, CI logs, crash dumps, or inherited subprocess environments. In a skill that manages broad DingTalk capabilities across mail, docs, contacts, and messaging, leaked app credentials could enable unauthorized API access depending on the app’s granted scopes.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The `scorecard update` command is presented as a normal management action without an adjacent explicit warning that it changes live performance-management data. In an agent skill context, ambiguous documentation around write operations can increase the chance of unintended destructive or organization-wide modifications if the agent executes updates based on incomplete user intent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.