DingTalk Skills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:54 AM UTC
• Version: 2.2.3

Overview

This DingTalk skill is not clearly malicious, but it needs review because it can send messages, approve workflows, delete schedules, overwrite documents, and expose employee or meeting data with limited built-in safeguards.

Install only for an authorized DingTalk tenant and use a least-privilege DingTalk app. Require human confirmation outside the skill before sending messages, approving/refusing or terminating workflows, deleting or canceling calendar items, creating meetings, exposing HR/directory records, or overwriting documents. Treat outputs such as employee lists, resignation records, meeting links, conference passwords, host passwords, and robot codes as sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (48)

Tainted flow: 'app_key' from os.environ.get (line 14, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def get_access_token():
    app_key, app_secret = get_credentials()
    print("正在获取 access_token...", file=sys.stderr)
    resp = requests.post(f"{OPEN_API_BASE}/oauth2/accessToken", json={
        "appKey": app_key,
        "appSecret": app_secret,
    })

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill declares that it must be used for essentially any DingTalk-related mention, creating an overly broad trigger surface for a high-privilege integration that can message users, manipulate approvals, schedule meetings, and modify documents. This increases the chance of unintended invocation, context hijacking, and execution of sensitive enterprise actions when the user's request is ambiguous or only tangentially related to DingTalk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Approval execution allows agreeing or refusing workflow tasks that can have real business consequences, yet the skill does not instruct the agent to warn the user or confirm intent before performing the action. Because approval actions are often time-sensitive and difficult to reverse, ambiguous requests or prompt manipulation could trigger unauthorized or mistaken business decisions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill includes cancellation and deletion operations for meetings and calendar events without requiring warnings about participant impact, notifications, or recovery limitations. In a broad-trigger enterprise assistant, these actions can disrupt schedules and collaboration if invoked accidentally, through ambiguity, or via adversarial prompting.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill exposes a full document overwrite operation and notes that it is a total replacement, but it does not require a user-facing confirmation step, preview, backup, or safer default such as append/edit mode. In an agent setting, this can cause irreversible loss of knowledge-base content through misunderstanding, prompt injection, or accidental invocation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The package description is extremely broad and advertises a wide set of high-privilege enterprise actions, but it does not define any activation boundaries, user-consent expectations, or task-specific constraints. In an agent setting, that ambiguity can cause over-invocation or misuse of sensitive capabilities such as user lookup, approvals, messaging, and document operations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The manifest exposes capabilities for sending messages, terminating or executing approvals, deleting events, canceling conferences, and overwriting documents, yet provides no visible warning or safeguard language about the operational impact of those actions. In an enterprise agent context, these functions can directly modify organizational data or communicate on behalf of users, making accidental or unauthorized execution materially dangerous.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends originator identity, department ID, and arbitrary form contents to a remote workflow API. Although it prints that an approval instance is being created, there is no disclosure that potentially sensitive user-supplied data will be transmitted over the network.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code retrieves an access token and performs a POST request to the calendar API containing the meeting title, times, location, and attendee unionIds. While there is a progress message about creating the meeting, there is no explicit disclosure that personal scheduling data and participant identifiers are being transmitted to an external service.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script sends participant identifiers to an external DingTalk API and returns sensitive meeting artifacts such as conference passwords, host passwords, phone numbers, and external join links directly in output. In an agent/skill context, exposing these credentials without explicit consent, warning, masking, or output-scoping can leak access to private meetings through logs, calling tools, or downstream consumers.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file's docstring, usage text, progress output, and success/error messages are all hard-coded in Chinese. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and multiple user-facing messages are written only in Chinese, including status output and error text. This imposes a specific language on users without any opt-in, fallback, or documented regional justification, which matches the language/locale policy violation criteria.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_access_token():
    app_key, app_secret = get_credentials()
    print("正在获取 access_token...", file=sys.stderr)
    resp = requests.post(f"{OPEN_API_BASE}/oauth2/accessToken", json={
        "appKey": app_key,
        "appSecret": app_secret,
    })

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script takes a phone number from the command line and sends it to a remote DingTalk API endpoint, which constitutes transmission of sensitive personal data. There is no consent prompt, privacy notice, masking, or validation of whether the operator is authorized to look up the user, so the script can enable unnecessary disclosure or misuse of personal information.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This code performs a network API call to fetch detailed user information for a department and then outputs the returned user list, which may contain personal or organizationally sensitive data. While there is a progress message, there is no user-facing warning in the docstring or output that the script will access and print employee details.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script enumerates and outputs the full list of users in a department, including employee identifiers and names, with no access-control checks, minimization, masking, or warning about handling directory data. In an agent/skill context, this creates a straightforward data-exfiltration primitive if invoked by an unauthorized user or exposed through automation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring is entirely in Chinese, and later user-facing output also uses Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should be optional or clearly justified; this file provides neither user opt-in nor explanation that the skill is China-specific.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The usage error message and progress message are presented only in Chinese. This is a natural-language policy issue because users are not given a language choice and the locale restriction is not explicitly justified in the file.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script retrieves employee resignation records, which are sensitive HR data, and outputs them directly without any user-facing warning, confirmation step, or minimization of exposed fields. In an agent-skill context, that increases the chance of accidental disclosure, inappropriate downstream logging, or use by an operator who does not realize the sensitivity of the returned records.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This file contains natural-language strings such as the module docstring and error/help text only in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring and CLI usage text are written only in Chinese, and the runtime status/error messages follow the same pattern. Under the policy for natural-language violations, forcing a specific language without user opt-in or justification is a reportable locale-policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The invalid-arguments message and the progress message printed to stderr are presented only in Chinese. This enforces a single language at runtime and does not give users a choice or explain a justified locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains natural-language strings such as the module docstring and runtime messages entirely in Chinese, which effectively forces a specific language for users. Under the policy, language-specific behavior should offer user opt-in or be clearly justified as locale-specific.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script’s docstring, usage text, status output, and success messages are all hard-coded in Chinese, with no indication that language selection is optional or that the tool is intended only for a Chinese-language environment. This creates a natural-language locale policy issue because the skill implicitly enforces a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script obtains an access token and performs an HTTP POST to send a direct message containing the supplied user ID and message body. Although it prints that a message is being sent, there is no user-facing warning or explanatory comment/docstring that this operation transmits potentially sensitive user data to an external service.

Static analysis

No suspicious patterns detected.