Ding Skills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:23 AM UTC
• Version: 2.3.1

Overview

This DingTalk skill matches its stated purpose, but it needs Review because it can perform high-impact business actions with broad activation rules and limited built-in safeguards.

Install only if you intend to give the agent DingTalk app credentials for broad enterprise automation. Configure the DingTalk app with the least permissions needed, require human confirmation in your agent workflow before sending messages, approving or rejecting workflows, deleting or cancelling calendar items, or overwriting documents, and avoid using it for casual DingTalk mentions unless the requested action is explicit.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (48)

Tainted flow: 'app_key' from os.environ.get (line 14, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/dingtalk_client.py (reported line 31)May include surrounding context.

python

def get_access_token():
    app_key, app_secret = get_credentials()
    print("正在获取 access_token...", file=sys.stderr)
    resp = requests.post(f"{OPEN_API_BASE}/oauth2/accessToken", json={
        "appKey": app_key,
        "appSecret": app_secret,
    })

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The activation rule is excessively broad: it triggers not only on explicit DingTalk task requests but on essentially any DingTalk mention and even all messages originating from a DingTalk channel. Because this skill exposes sensitive actions such as user lookup, approvals, messaging, calendar access, and document overwrite, over-activation increases the chance the agent routes ordinary conversation into high-privilege enterprise operations without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documents numerous destructive or privacy-impacting capabilities—sending messages, approving/rejecting workflows, transferring approval tasks, deleting events, canceling conferences, and overwriting documents—without requiring user confirmation or warning about consequences. In an agent setting, this omission makes accidental or prompt-induced execution more likely, potentially causing unauthorized data disclosure, workflow manipulation, or irreversible content changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This manifest file describes the skill as a 'full-featured' DingTalk skill set covering many administrative and messaging functions, but it provides no explicit trigger scope, invocation constraints, or exclusion conditions. In a manifest context, such broad natural-language capability descriptions can contribute to ambiguous activation and unintended invocation because users or orchestrators are not told when these functions should or should not be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script performs a destructive cancellation action immediately from command-line arguments and provides no explicit confirmation, dry-run mode, or safeguard against accidental execution. In an agent/automation context, this increases the chance of unintended cancellation of legitimate meetings, especially if inputs are malformed, spoofed, or passed through another tool without human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends potentially sensitive workflow data, including originatorUserId, deptId, ccList, and form contents, to a remote API via api_request. While there is a stderr progress message, it does not disclose what data is being transmitted or warn the user about the external network action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code performs an HTTP API request to create a meeting and includes attendee IDs, meeting title, time, and optional location in the request body. Although there is a progress message, it does not disclose that user scheduling data is being transmitted to an external calendar service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's docstring and runtime usage/error text are entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific environment. This matches the policy category for language or locale constraints that are not optional or justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code performs an irreversible DELETE request against a user's calendar event. Although it prints a status message and the file docstring says '删除日程', there is no explicit warning, confirmation, or comment disclosing that this is a destructive operation that permanently removes user data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/dingtalk_client.py (reported line 31)May include surrounding context.

python

def get_access_token():
    app_key, app_secret = get_credentials()
    print("正在获取 access_token...", file=sys.stderr)
    resp = requests.post(f"{OPEN_API_BASE}/oauth2/accessToken", json={
        "appKey": app_key,
        "appSecret": app_secret,
    })

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's natural-language strings and usage instructions are entirely in Chinese, including the docstring and error message, with no indication that users may choose another language or that the skill is restricted to a Chinese-only context. This creates a locale-policy concern because the skill appears to impose a specific language by default rather than offering opt-in or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code transmits the provided mobile number to a remote DingTalk API endpoint, which is a privacy-relevant operation. Although there is a stderr progress message, it does not disclose that personal data is being sent off-host, and the file-level docstring only says it queries by mobile number without warning about network transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is entirely in Chinese, and the script also emits a Chinese-only status message. This imposes a specific language on users without offering a language choice or documenting a justified locale restriction, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs a network API call to fetch detailed user records for an entire department and then emits that data in the output. Although there is a progress message, it does not disclose that potentially sensitive employee information will be retrieved and displayed, so the user is not meaningfully warned about the privacy-sensitive operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script retrieves calendar events for any supplied union_id and emits potentially sensitive scheduling data, including summaries, times, status, and onlineMeetingInfo, without any visible authorization check, ownership validation, or consent warning in the script itself. In an agent-skill context, this is dangerous because it can facilitate unauthorized access to personal calendar information if the surrounding system allows callers to provide arbitrary user identifiers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring presents the skill purpose and usage only in Chinese, which imposes a specific language on users without opt-in. The policy specifically flags language or locale constraints when no user choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script emits usage/error and progress messages in Chinese only, which enforces a language choice at runtime. Because there is no documented option for another language or clear locale justification in the file, this is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs an HTTP API request to retrieve employee leave/resignation records, which are sensitive HR data. Although there is a progress message on stderr, the script does not clearly disclose that it will access and transmit personnel data to an external service in a user-facing warning or explanatory comment/docstring beyond the terse title.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and CLI usage text are written only in Chinese, and the runtime status/error messages are also Chinese-only. For a general-purpose script, this imposes a fixed language on users without opt-in or a documented regional justification, which matches the locale-policy violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invalid-arguments message and progress print statement are presented only in Chinese. Because the script does not offer language selection or explain a justified locale restriction, it enforces a specific language in user-visible output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file includes natural-language docstrings and runtime messages only in Chinese, which forces a specific language on users. Under the policy, locale or language constraints should either be optional, user-selectable, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and usage text are written only in Chinese, and the runtime status/error messages are also Chinese-only. This creates a language-policy issue because the skill imposes a specific language on all users without opt-in or any documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invalid-arguments message shown to users is Chinese-only, which enforces a specific language in user-facing output. There is no indication in the file that this locale restriction is optional or justified by the skill's scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The stderr status message is hardcoded in Chinese, which means all users receive Chinese output regardless of preference. The file does not indicate that the skill is region-specific or that users can select their locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends a user-provided search keyword to the remote /contact/users/search API, which may transmit personal or directory-related data. The only visible output is a generic "searching users" message, and there is no explicit warning in the file that the keyword will be sent to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.