dingtalk-feishu-cn

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward DingTalk/Feishu integration guide; its network and SDK examples are expected for that purpose, though users should handle webhook tokens and dependencies carefully.

Install only if you intend to work with DingTalk or Feishu/Lark. Treat webhook URLs, app IDs, and app secrets as credentials, install SDKs in an isolated environment, and consider pinning reviewed dependency versions before use in production or CI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned and Unverified Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52 and 76
Vulnerability Type: Supply-chain risk from mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

Line 52:

bash

pip install dingtalk-sdk

Line 76:

bash

pip install lark-oapi

Technical Analysis

The installation instructions resolve third-party packages without specifying reviewed versions, cryptographic hashes, a lockfile, or a verified package source. Consequently, the code installed by these commands may change over time without any corresponding change to the audited Skill.

If an upstream release, package-publishing account, configured package index, or transitively resolved build dependency is compromised, pip could retrieve attacker-controlled content. Malicious package code may execute during source-package build operations or later when the installed module is imported by the documented integration code.

This finding does not establish that the current dingtalk-sdk or lark-oapi releases are malicious. The vulnerability is that the instructions provide no mechanism to ensure users receive the same reviewed artifacts on every installation.

Attack Path

1. An attacker compromises an upstream package release, publishing account, configured Python package index, or build dependency.
2. The attacker publishes a malicious version that remains compatible with the unpinned package name.
3. A user or CI process follows SKILL.md and runs one of the documented pip install commands.
4. pip resolves the attacker-controlled version because no approved version or hash is enforced.
5. Malicious logic runs during package build or when the documented module is subsequently imported.
6. The payload operates with the privileges of the user or CI account performing the installation or import.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the ins ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Select and document explicitly reviewed package versions rather than resolving the latest available releases:

   text

   dingtalk-sdk==REVIEWED_VERSION
   lark-oapi==REVIEWED_VERSION
   

2. Generate a dependency lock or requirements file containing cryptographic hashes for all direct and transitive distributions.

3. Require hash verification during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Verify package ownership, provenance, release history, and source repository before approving versions. Where supported, validate signed provenance or trusted-publisher metadata.

5. Install dependencies inside a dedicated virtual environment or container using a non-privileged account. Do not use administrator-level or system-wide installation unless strictly required.

6. Configure CI systems to install only from an approved package index and prevent fallback to untrusted public or extra indexes.

7. Add automated dependency scanning and establish a controlled update process in which new versions and hashes are reviewed before adoption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash

# 发送消息
curl -X POST "https://oapi.dingtalk.com/robot/send?access_token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "msgtype": "text",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description and keywords explicitly constrain the skill to Chinese enterprise communication platforms and label it as China-focused, but the manifest does not indicate that this locale limitation is optional or justified as a region-specific compliance requirement. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.